diff --git a/.circleci/config.yml b/.circleci/config.yml index 1dacae4d2e..90855706c6 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -496,14 +496,12 @@ workflows: filters: tags: only: /.*/ - - run-appinspect: # build always requires: - validate-content - build-sources - build-package - filters: tags: only: /^v.*/ @@ -514,7 +512,6 @@ workflows: - validate-content - build-sources - build-package - - run-appinspect filters: tags: @@ -527,7 +524,6 @@ workflows: - validate-content - build-sources - build-package - - run-appinspect - create-report filters: @@ -541,7 +537,6 @@ workflows: - validate-content - build-sources - build-package - - run-appinspect - create-report - update-sources-github @@ -556,7 +551,6 @@ workflows: - validate-content - build-sources - build-package - - run-appinspect - create-report - update-sources-github @@ -571,7 +565,7 @@ workflows: requires: - validate-content - build-sources - - build-package + - build-package - run-appinspect - create-report - update-sources-github @@ -581,4 +575,19 @@ workflows: tags: only: /^v.*/ branches: - ignore: /.*/ \ No newline at end of file + ignore: /.*/ + + detection-testing: + jobs: + - hold: + type: approval + filters: + tags: + only: /^v.*/ + - detection-testing: + # build always + requires: + - hold + filters: + tags: + only: /^v.*/ \ No newline at end of file diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py index 9b6fa4e552..cdb2502b3e 100644 --- a/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py +++ b/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py @@ -51,7 +51,12 @@ def test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_ def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_file, test_index, uuid_test, uuid_var): - test_file_obj = load_file("security_content/" + test_file[2:]) + try: + test_file_obj = load_file("security_content/" + test_file[2:]) + except Exception as e: + print('Error: ' + str(e)) + return + if not test_file_obj: return #print(test_file_obj) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 6931d18528..1e645ecf3a 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -28,6 +28,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -47,6 +50,3 @@ tags: - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index c758e76a03..0fbdb3e353 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -12,11 +12,11 @@ description: This search is to detect a suspicious modification to the firewall more files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe - Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `allow_network_discovery_in_firewall_filter`' + Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" + Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -30,6 +30,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -48,6 +51,3 @@ tags: - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index e6ff7bc6da..2d4d22dadc 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -80,4 +80,4 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 3349a6a5ee..427eec0522 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -11,9 +11,9 @@ description: This following analytic detects PowerShell command to delete shadow to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" + OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 6036c2afec..1224aed466 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -20,7 +20,7 @@ description: 'The following analytic identifies the use of WMI Event Subscriptio 1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ 1. Binding - Registers a filter to a consumer. EventID equals 21 \ - + Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index c565d442b8..eb39ed482f 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -28,6 +28,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,6 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 12636217c6..21578dd058 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -26,6 +26,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,6 +45,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 3c1898bd59..4353463a32 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -10,15 +10,15 @@ description: This search is to identifies a modification in registry to disable windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where - Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR - Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR - Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR - Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR - Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR - Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR - Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" - Registry.registry_value_name = "DWORD (0x00000001)" + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows + Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= + "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" + OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time + Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= + "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= + "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time + Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 4d6167884d..2fbb659e41 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -46,4 +46,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 660fa798af..7310ea2517 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -27,6 +27,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,6 +44,3 @@ tags: - process_name - process security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index b44f56efbd..4d6a00cb40 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -25,6 +25,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,6 +46,3 @@ tags: - Processes.dest - Processes.user security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 310ba559c5..1b2ffe5569 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -27,6 +27,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,6 +46,3 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 3f39baed5c..ec33904c56 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -27,6 +27,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,6 +48,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 6fa038868e..2ca40212f7 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -24,6 +24,9 @@ tags: analytic_story: - Malicious PowerShell - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -39,6 +42,3 @@ tags: - ComputerName - User security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index c2f72a3484..5029a4ad3c 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -27,6 +27,9 @@ references: tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,6 +48,3 @@ tags: - Processes.dest - Processes.user security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 7690d913aa..9c43f53a5d 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -13,10 +13,11 @@ description: This analytic identifies suspicious modification in registry entry notes file name in the compromised host. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") - AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary - Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name + = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name + Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' how_to_implement: to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 0d50587209..c6b479fa22 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -10,15 +10,17 @@ description: This analytic identifies suspicious series of attempt to kill multi services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), - process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), - ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name + = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -46,4 +48,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 0ed8cd3fb1..05865adfa6 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -10,15 +10,17 @@ description: This analytic will identify suspicious series of command-line to di several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system. -search: '| from read_ssa_enriched_events() - | eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection", []), body={} - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), - process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), - ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, + "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, + "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -48,4 +50,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 335d60b245..18226a3a7c 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -12,17 +12,21 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' -how_to_implement: o successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: o successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed net.exe may be used. known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. references: @@ -47,4 +51,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index e7de2b496b..d7d1aff9a1 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -10,19 +10,24 @@ description: This analytic will identify a suspicious command-line that disables user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. -known_false_positives: network operator may use this approach to quickly disable an account but not a common practice. +known_false_positives: network operator may use this approach to quickly disable an + account but not a common practice. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -45,4 +50,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 2aa0fdf641..15aa136dae 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -12,13 +12,18 @@ description: The following analytics identifies the resizing of shadowstorage by team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, + "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -47,4 +52,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 46948ce1bc..9df7e1c295 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.25.0" + "version": "3.25.1" }, "author": [ { diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 5862856196..29e609d4e5 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T07:57:29 UTC +# On Date: 2021-07-13T23:06:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1487,9 +1487,7 @@ support_searches = [] data_models = ["Endpoint"] providing_technologies = none description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. -narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ -The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ -In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. +narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] [Suspicious Windows Registry Activities] diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index a321aaef25..ae9e96c293 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-02T15:44:59 UTC +# On Date: 2021-07-13T23:06:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -546,7 +546,7 @@ version = 5 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ The following factors may assist you in determining whether the event is malicious: \ @@ -720,7 +720,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -742,7 +742,7 @@ version = 1 references = ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"] +searches = ["ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more. narrative = Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. @@ -1026,9 +1026,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. -narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ -The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ -In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. +narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. [analytic_story://Suspicious Windows Registry Activities] category = Adversary Tactics @@ -1557,6 +1555,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.00 known_false_positives = admin or power user may used this series of command. providing_technologies = [] +[savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered. +providing_technologies = [] + [savedsearch://ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule] type = detection asset_type = @@ -1577,6 +1585,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.00 known_false_positives = administrator may allow inbound traffic in certain network or machine. providing_technologies = [] +[savedsearch://ESCU - Allow Network Discovery In Firewall - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered. +providing_technologies = [] + [savedsearch://ESCU - Allow Operation with Consent Admin - Rule] type = detection asset_type = @@ -3008,11 +3026,11 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ -1. Filter - WQL Query for the events we want. EventID = 19 \ -1. Consumer - An action to take upon triggering the filter. EventID = 20 \ -1. Binding - Registers a filter to a consumer. EventID = 21 \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} @@ -3167,6 +3185,26 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Action known_false_positives = While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose. providing_technologies = [] +[savedsearch://ESCU - Disable AMSI Through Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +known_false_positives = network operator may disable this feature of windows but not so common. +providing_technologies = [] + +[savedsearch://ESCU - Disable ETW Through Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +known_false_positives = network operator may disable this feature of windows but not so common. +providing_technologies = [] + [savedsearch://ESCU - Disable Logs Using WevtUtil - Rule] type = detection asset_type = @@ -3541,6 +3579,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} known_false_positives = unknown. Filter as needed. Modify the time span as needed. providing_technologies = [] +[savedsearch://ESCU - Excessive Usage Of SC Service Utility - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569.002"]} +known_false_positives = excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission. +providing_technologies = [] + [savedsearch://ESCU - Excessive Usage Of Taskkill - Rule] type = detection asset_type = @@ -3601,6 +3649,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]} known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Execute Javascript With Jscript COM CLSID - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Execution of File With Spaces Before Extension - Rule] type = detection asset_type = Endpoint @@ -4215,6 +4273,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": [" known_false_positives = None at this time providing_technologies = [] +[savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]} +known_false_positives = quite minimal false positive expected. +providing_technologies = [] + [savedsearch://ESCU - Multiple Archive Files Http Post Traffic - Rule] type = detection asset_type = @@ -4715,6 +4783,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.00 known_false_positives = powershell developer may used this function in their script for instance checking too. providing_technologies = [] +[savedsearch://ESCU - Powershell Disable Security Monitoring - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +known_false_positives = Limited false positives. However, tune based on scripts that may perform this action. +providing_technologies = [] + +[savedsearch://ESCU - Powershell Enable SMB1Protocol Feature - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +known_false_positives = network operator may enable or disable this windows feature. +providing_technologies = [] + [savedsearch://ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule] type = detection asset_type = @@ -4946,6 +5034,16 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592" known_false_positives = network administrator may used this command for checking purposes providing_technologies = [] +[savedsearch://ESCU - Recursive Delete of Directory In Batch CMD - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +known_false_positives = network operator may use this batch command to delete recursively a directory or files within directory +providing_technologies = [] + [savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule] type = detection asset_type = Endpoint @@ -5983,7 +6081,7 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID = 19 \ 1. Consumer - An action to take upon triggering the filter. EventID = 20 \ diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 09df733bcb..0a04a2c30d 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 32560 +build = 34075 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.25.0 +version = 3.25.1 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 1eb17031fd..e6fff8d394 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T07:57:29 UTC +# On Date: 2021-07-13T23:06:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index a2f4506a6a..b4525fb5b0 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.25.0 +version = 3.25.1 diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index a1c2117d1d..bc4fd4fdf4 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T07:57:29 UTC +# On Date: 2021-07-13T23:06:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index fcd1e3411f..a3c29701e8 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T07:57:29 UTC +# On Date: 2021-07-13T23:06:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -7323,10 +7323,20 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Detect WMI Event Subscription Persistence - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. +description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ +All event subscriptions have three components \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ +Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. +action.escu.eli5 = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ +All event subscriptions have three components \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ +Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume. action.escu.known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage. action.escu.creation_date = 2021-06-16 @@ -7345,7 +7355,12 @@ action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistenc action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. +action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ +All event subscriptions have three components \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ +Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. action.notable.param.rule_title = Detect WMI Event Subscription Persistence action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -19707,7 +19722,7 @@ search = `wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(? + +--- + +### Allow File And Printing Sharing In Firewall +This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.007](https://attack.mitre.org/techniques/T1562/007/) +- **Last Updated**: 2021-06-23 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_file_and_printing_sharing_in_firewall_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + +* Processes.parent_process_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network admin may modify this firewall feature that may cause this rule to be triggered. + +#### Reference + + +* https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + _version_: 1
@@ -7720,6 +7984,92 @@ administrator may allow inbound traffic in certain network or machine. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log +_version_: 1 + + +--- + +### Allow Network Discovery In Firewall +This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.007](https://attack.mitre.org/techniques/T1562/007/) +- **Last Updated**: 2021-06-23 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_network_discovery_in_firewall_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + +* Processes.parent_process_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network admin may modify this firewall feature that may cause this rule to be triggered. + +#### Reference + + +* https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + _version_: 1
@@ -8547,6 +8897,89 @@ _version_: 6 --- +### Attempt To Disable Services +This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1489](https://attack.mitre.org/techniques/T1489/) +- **Last Updated**: 2021-06-18 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection", []), body={} +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1489 | Service Stop | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + + +_version_: 1 +
+ +--- + ### Attempt To Stop Security Service This search looks for attempts to stop security-related services on the endpoint. @@ -8623,6 +9056,86 @@ _version_: 3 --- +### Attempt To delete Services +This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1489](https://attack.mitre.org/techniques/T1489/) +- **Last Updated**: 2021-06-18 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1489 | Service Stop | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + + +_version_: 1 +
+ +--- + ### Attempted Credential Dump From Registry via Reg exe Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. @@ -12851,6 +13364,86 @@ Limited false positives. If there is a true false positive, filter based on comm * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Delete A Net User +This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1489](https://attack.mitre.org/techniques/T1489/) +- **Last Updated**: 2021-06-21 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + +* Ransomware + + +#### How To Implement +o successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1489 | Service Stop | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +System administrators or scripts may delete user accounts via this technique. Filter as needed. + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + + _version_: 1
@@ -12869,7 +13462,7 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Search ``` -`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -19117,11 +19710,11 @@ _version_: 4 --- ### Detect WMI Event Subscription Persistence -The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ -1. Filter - WQL Query for the events we want. EventID = 19 \ -1. Consumer - An action to take upon triggering the filter. EventID = 20 \ -1. Binding - Registers a filter to a consumer. EventID = 21 \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -19951,6 +20544,160 @@ _version_: 3 --- +### Disable AMSI Through Registry +this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562/001/) +- **Last Updated**: 2021-06-22 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_amsi_through_registry_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may disable this feature of windows but not so common. + +#### Reference + + +* https://blog.f-secure.com/hunting-for-amsi-bypasses/ + +* https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable ETW Through Registry +this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562/001/) +- **Last Updated**: 2021-06-22 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_etw_through_registry_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may disable this feature of windows but not so common. + +#### Reference + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Disable Logs Using WevtUtil This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. @@ -20028,6 +20775,86 @@ network operator may disable audit event logs for debugging purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +_version_: 1 + + +--- + +### Disable Net User Account +This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1489](https://attack.mitre.org/techniques/T1489/) +- **Last Updated**: 2021-06-21 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1489 | Service Stop | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may use this approach to quickly disable an account but not a common practice. + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + + _version_: 1
@@ -20282,7 +21109,7 @@ This search is to identifies a modification in registry to disable the windows d #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -20292,6 +21119,10 @@ This search is to identifies a modification in registry to disable the windows d * Windows Defense Evasion Tactics +* Ransomware + +* Revil Ransomware + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -22255,7 +23086,7 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Search ``` -| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -22266,6 +23097,8 @@ This analytic identifies suspicious series of attempt to kill multiple services * XMRig +* Ransomware + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. @@ -22424,6 +23257,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc * XMRig +* Ransomware + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. @@ -22473,6 +23308,82 @@ unknown. Filter as needed. Modify the time span as needed. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +_version_: 1 + + +--- + +### Excessive Usage Of SC Service Utility +This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1569.002](https://attack.mitre.org/techniques/T1569/002/) +- **Last Updated**: 2021-06-24 + +
+ details + +#### Search +``` +`sysmon` EventCode = 1 process_name = "sc.exe" +| bucket _time span=15m +| stats values(process) as process count as numScExe by Computer, _time +| eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer +| eval upperThreshold=(avgScExe + stdScExe *3) +| eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) +| search isOutlier=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_usage_of_sc_service_utility_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. + +#### Required field + +* _time + +* EventCode + +* process_name + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1569.002 | Service Execution | Execution | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission. + +#### Reference + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + _version_: 1
@@ -22599,17 +23510,11 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.dest +* Computer -* Processes.user +* process_name -* Processes.parent_process - -* Processes.process_name - -* Processes.process - -* Processes.process_id +* EventCode @@ -22955,6 +23860,86 @@ Administrators may allow creation of script or exe in the paths specified. Filte * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +_version_: 1 + + +--- + +### Execute Javascript With Jscript COM CLSID +This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1059.005](https://attack.mitre.org/techniques/T1059/005/) +- **Last Updated**: 2021-06-22 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `execute_javascript_with_jscript_com_clsid_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.parent_process + +* Processes.process_id + +* Processes.dest + +* Processes.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1059.005 | Visual Basic | Execution | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + _version_: 1
@@ -24301,6 +25286,8 @@ This analytic identifies potential adversaries that modify the security permissi * XMRig +* Ransomware + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. @@ -26530,6 +27517,84 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s #### Test Dataset +_version_: 1 + + +--- + +### Msmpeng Application DLL Side Loading +This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1574.002](https://attack.mitre.org/techniques/T1574/002/) +- **Last Updated**: 2021-07-05 + +
+ details + +#### Search +``` + +|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `msmpeng_application_dll_side_loading_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +#### Required field + +* _time + +* Filesystem.file_create_time + +* Filesystem.process_id + +* Filesystem.file_name + +* Filesystem.user + +* Filesystem.file_path + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +quite minimal false positive expected. + +#### Reference + + +* https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + + _version_: 1
@@ -30183,6 +31248,163 @@ powershell developer may used this function in their script for instance checkin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log +_version_: 1 + + +--- + +### Powershell Disable Security Monitoring +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562/001/) +- **Last Updated**: 2021-07-05 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_disable_security_monitoring_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. However, tune based on scripts that may perform this action. + +#### Reference + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Powershell Enable SMB1Protocol Feature +This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1027.005](https://attack.mitre.org/techniques/T1027/005/) +- **Last Updated**: 2021-06-22 + +
+ details + +#### Search +``` +`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_enable_smb1protocol_feature_filter` +``` +#### Associated Analytic Story + +* Malicious PowerShell + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +#### Required field + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1027.005 | Indicator Removal from Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may enable or disable this windows feature. + +#### Reference + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log + + _version_: 1
@@ -33053,6 +34275,86 @@ None identified. #### Test Dataset +_version_: 1 + + +--- + +### Recursive Delete of Directory In Batch CMD +This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1070.004](https://attack.mitre.org/techniques/T1070/004/) +- **Last Updated**: 2021-06-22 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest +|`drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `recursive_delete_of_directory_in_batch_cmd_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.parent_process + +* Processes.process_id + +* Processes.dest + +* Processes.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1070.004 | File Deletion | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may use this batch command to delete recursively a directory or files within directory + +#### Reference + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + _version_: 1
@@ -33816,6 +35118,88 @@ network admin can resize the shadowstorage for valid purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log +_version_: 1 + + +--- + +### Resize Shadowstorage Volume +The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1489](https://attack.mitre.org/techniques/T1489/) +- **Last Updated**: 2021-06-21 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* Clop Ransomware + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1489 | Service Stop | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network admin can resize the shadowstorage for valid purposes. + +#### Reference + + +* https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html + +* https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + + _version_: 1
@@ -33921,7 +35305,7 @@ This analytic identifies suspicious modification in registry entry to keep some #### Search ``` -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -40543,7 +41927,7 @@ _version_: 1 --- ### WMI Permanent Event Subscription - Sysmon -This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID = 19 \ 1. Consumer - An action to take upon triggering the filter. EventID = 20 \ diff --git a/docs/detections.wiki b/docs/detections.wiki index 3ec0522a32..ec89bbb541 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -6761,6 +6761,95 @@ admin or power user may used this series of command. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +''version'': 1 + + + +---- + +===Allow file and printing sharing in firewall=== +This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''Last Updated''': 2021-06-23 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_file_and_printing_sharing_in_firewall_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + +* Processes.parent_process_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.007 +| Disable or Modify Cloud Firewall +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network admin may modify this firewall feature that may cause this rule to be triggered. + +====Reference==== + + +* https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + ''version'': 1
@@ -6927,6 +7016,97 @@ administrator may allow inbound traffic in certain network or machine. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log +''version'': 1 + + + +---- + +===Allow network discovery in firewall=== +This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''Last Updated''': 2021-06-23 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_network_discovery_in_firewall_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + +* Processes.parent_process_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.007 +| Disable or Modify Cloud Firewall +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network admin may modify this firewall feature that may cause this rule to be triggered. + +====Reference==== + + +* https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + ''version'': 1
@@ -7708,6 +7888,94 @@ There may be legitimate reasons for administrators to add a certificate to the u ---- +===Attempt to disable services=== +This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] +* '''Last Updated''': 2021-06-18 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection", []), body={} +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1489 +| Service Stop +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + + +''version'': 1 +
+
+ +---- + ===Attempt to stop security service=== This search looks for attempts to stop security-related services on the endpoint. @@ -7789,6 +8057,91 @@ None identified. Attempts to disable security-related services should be identif ---- +===Attempt to delete services=== +This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] +* '''Last Updated''': 2021-06-18 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1489 +| Service Stop +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + + +''version'': 1 +
+
+ +---- + ===Attempted credential dump from registry via reg exe=== Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. @@ -11320,6 +11673,91 @@ Limited false positives. If there is a true false positive, filter based on comm * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Delete a net user=== +This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] +* '''Last Updated''': 2021-06-21 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +o successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1489 +| Service Stop +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +System administrators or scripts may delete user accounts via this technique. Filter as needed. + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + + ''version'': 1
@@ -11338,7 +11776,7 @@ This following analytic detects PowerShell command to delete shadow copy using t
====Search==== -`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -15978,11 +16416,11 @@ Some legitimate applications may exhibit this behavior. ---- ===Detect wmi event subscription persistence=== -The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ -1. Filter - WQL Query for the events we want. EventID = 19 \ -1. Consumer - An action to take upon triggering the filter. EventID = 20 \ -1. Binding - Registers a filter to a consumer. EventID = 21 \ +1. Filter - WQL Query for the events we want. EventID equals 19 \ +1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ +1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -16400,6 +16838,170 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that ---- +===Disable amsi through registry=== +this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''Last Updated''': 2021-06-22 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_amsi_through_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may disable this feature of windows but not so common. + +====Reference==== + + +* https://blog.f-secure.com/hunting-for-amsi-bypasses/ + +* https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable etw through registry=== +this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''Last Updated''': 2021-06-22 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_etw_through_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may disable this feature of windows but not so common. + +====Reference==== + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Disable logs using wevtutil=== This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. @@ -16481,6 +17083,91 @@ network operator may disable audit event logs for debugging purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +''version'': 1 +
+ + +---- + +===Disable net user account=== +This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] +* '''Last Updated''': 2021-06-21 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1489 +| Service Stop +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may use this approach to quickly disable an account but not a common practice. + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + + ''version'': 1
@@ -16753,7 +17440,7 @@ This search is to identifies a modification in registry to disable the windows d ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -16763,6 +17450,10 @@ This search is to identifies a modification in registry to disable the windows d * [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -18545,7 +19236,7 @@ This analytic identifies suspicious series of attempt to kill multiple services ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -18556,6 +19247,8 @@ This analytic identifies suspicious series of attempt to kill multiple services * [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. @@ -18724,6 +19417,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc * [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. @@ -18778,6 +19473,87 @@ unknown. Filter as needed. Modify the time span as needed. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +''version'': 1 + + + +---- + +===Excessive usage of sc service utility=== +This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''Last Updated''': 2021-06-24 + +
+
+ +====Search==== +`sysmon` EventCode = 1 process_name = "sc.exe" +| bucket _time span=15m +| stats values(process) as process count as numScExe by Computer, _time +| eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer +| eval upperThreshold=(avgScExe + stdScExe *3) +| eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) +| search isOutlier=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_usage_of_sc_service_utility_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. + +====Required field==== + +* _time + +* EventCode + +* process_name + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1569.002 +| Service Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission. + +====Reference==== + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + ''version'': 1
@@ -18909,17 +19685,11 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.dest +* Computer -* Processes.user +* process_name -* Processes.parent_process - -* Processes.process_name - -* Processes.process - -* Processes.process_id +* EventCode @@ -19290,6 +20060,91 @@ Administrators may allow creation of script or exe in the paths specified. Filte * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +''version'': 1 + + + +---- + +===Execute javascript with jscript com clsid=== +This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/005/ T1059.005] +* '''Last Updated''': 2021-06-22 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `execute_javascript_with_jscript_com_clsid_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.parent_process + +* Processes.process_id + +* Processes.dest + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1059.005 +| Visual Basic +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + ''version'': 1
@@ -20403,6 +21258,8 @@ This analytic identifies potential adversaries that modify the security permissi * [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. @@ -22551,6 +23408,89 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s ====Test Dataset==== +''version'': 1 + + + +---- + +===Msmpeng application dll side loading=== +This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/002/ T1574.002] +* '''Last Updated''': 2021-07-05 + +
+
+ +====Search==== + +|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `msmpeng_application_dll_side_loading_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +====Required field==== + +* _time + +* Filesystem.file_create_time + +* Filesystem.process_id + +* Filesystem.file_name + +* Filesystem.user + +* Filesystem.file_path + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1574.002 +| DLL Side-Loading +| Persistence, Privilege Escalation, Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +quite minimal false positive expected. + +====Reference==== + + +* https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + + ''version'': 1
@@ -24837,6 +25777,173 @@ powershell developer may used this function in their script for instance checkin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log +''version'': 1 + + + +---- + +===Powershell disable security monitoring=== +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''Last Updated''': 2021-07-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_disable_security_monitoring_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. However, tune based on scripts that may perform this action. + +====Reference==== + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Powershell enable smb1protocol feature=== +This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/005/ T1027.005] +* '''Last Updated''': 2021-06-22 + +
+
+ +====Search==== +`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_enable_smb1protocol_feature_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +====Required field==== + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1027.005 +| Indicator Removal from Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may enable or disable this windows feature. + +====Reference==== + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log + + ''version'': 1
@@ -27798,6 +28905,91 @@ None identified. ====Test Dataset==== +''version'': 1 + + + +---- + +===Recursive delete of directory in batch cmd=== +This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/004/ T1070.004] +* '''Last Updated''': 2021-06-22 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest +|`drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `recursive_delete_of_directory_in_batch_cmd_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.parent_process + +* Processes.process_id + +* Processes.dest + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1070.004 +| File Deletion +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may use this batch command to delete recursively a directory or files within directory + +====Reference==== + + +* https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + + ''version'': 1
@@ -28450,6 +29642,93 @@ network admin can resize the shadowstorage for valid purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log +''version'': 1 + + + +---- + +===Resize shadowstorage volume=== +The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] +* '''Last Updated''': 2021-06-21 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Clop_Ransomware|Clop Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1489 +| Service Stop +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network admin can resize the shadowstorage for valid purposes. + +====Reference==== + + +* https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html + +* https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + + ''version'': 1
@@ -28560,7 +29839,7 @@ This analytic identifies suspicious modification in registry entry to keep some ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -34980,7 +36259,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur ---- ===Wmi permanent event subscription - sysmon=== -This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. +This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID = 19 \ 1. Consumer - An action to take upon triggering the filter. EventID = 20 \ @@ -39696,7 +40975,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-07-02 15:57:11.009427 UTC''
+# On Date: 2021-07-13 23:18:19.885161 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 9e952cd291..5daf61eae2 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -151,9 +151,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -290,7 +295,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -514,12 +519,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -536,15 +541,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -715,25 +722,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -742,9 +752,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -789,9 +800,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -830,8 +841,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -904,8 +915,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -931,7 +942,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -947,7 +959,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -970,7 +982,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -1009,9 +1021,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -1236,9 +1249,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -1375,7 +1393,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -1599,12 +1617,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -1621,15 +1639,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -1800,25 +1820,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -1827,9 +1850,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -1874,9 +1898,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -1915,8 +1939,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -1989,8 +2013,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -2016,7 +2040,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -2032,7 +2057,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -2055,7 +2080,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -2094,9 +2119,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -2321,9 +2347,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -2460,7 +2491,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -2684,12 +2715,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -2706,15 +2737,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -2885,25 +2918,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -2912,9 +2948,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -2959,9 +2996,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -3000,8 +3037,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -3074,8 +3111,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -3101,7 +3138,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -3117,7 +3155,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -3140,7 +3178,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -3179,9 +3217,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -3406,9 +3445,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -3545,7 +3589,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -3769,12 +3813,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -3791,15 +3835,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -3970,25 +4016,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -3997,9 +4046,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -4044,9 +4094,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -4085,8 +4135,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -4159,8 +4209,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -4186,7 +4236,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -4202,7 +4253,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -4225,7 +4276,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -4264,9 +4315,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -4491,9 +4543,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -4630,7 +4687,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -4854,12 +4911,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -4876,15 +4933,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -5055,25 +5114,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -5082,9 +5144,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -5129,9 +5192,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -5170,8 +5233,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -5244,8 +5307,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -5271,7 +5334,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -5287,7 +5351,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -5310,7 +5374,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -5349,9 +5413,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -5576,9 +5641,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -5715,7 +5785,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -5939,12 +6009,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -5961,15 +6031,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -6140,25 +6212,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -6167,9 +6242,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -6214,9 +6290,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -6255,8 +6331,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -6329,8 +6405,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -6356,7 +6432,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -6372,7 +6449,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -6395,7 +6472,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -6434,9 +6511,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -6661,9 +6739,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -6800,7 +6883,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -7024,12 +7107,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -7046,15 +7129,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -7225,25 +7310,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -7252,9 +7340,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -7299,9 +7388,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -7340,8 +7429,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -7414,8 +7503,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -7441,7 +7530,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -7457,7 +7547,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -7480,7 +7570,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -7519,9 +7609,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -7746,9 +7837,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -7885,7 +7981,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -8109,12 +8205,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -8131,15 +8227,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -8310,25 +8408,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -8337,9 +8438,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -8384,9 +8486,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -8425,8 +8527,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -8499,8 +8601,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -8526,7 +8628,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -8542,7 +8645,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -8565,7 +8668,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -8604,9 +8707,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -8831,9 +8935,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -8970,7 +9079,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -9194,12 +9303,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -9216,15 +9325,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -9395,25 +9506,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -9422,9 +9536,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -9469,9 +9584,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -9510,8 +9625,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -9584,8 +9699,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -9611,7 +9726,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -9627,7 +9743,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -9650,7 +9766,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -9689,9 +9805,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -9916,9 +10033,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -10055,7 +10177,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -10279,12 +10401,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -10301,15 +10423,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -10480,25 +10604,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -10507,9 +10634,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -10554,9 +10682,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -10595,8 +10723,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -10669,8 +10797,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -10696,7 +10824,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -10712,7 +10841,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -10735,7 +10864,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -10774,9 +10903,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -11001,9 +11131,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -11140,7 +11275,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -11364,12 +11499,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -11386,15 +11521,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -11565,25 +11702,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -11592,9 +11732,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -11639,9 +11780,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -11680,8 +11821,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -11754,8 +11895,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -11781,7 +11922,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -11797,7 +11939,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -11820,7 +11962,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -11859,9 +12001,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -12086,9 +12229,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -12225,7 +12373,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -12449,12 +12597,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -12471,15 +12619,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -12650,25 +12800,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -12677,9 +12830,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -12724,9 +12878,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -12765,8 +12919,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -12839,8 +12993,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -12866,7 +13020,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -12882,7 +13037,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -12905,7 +13060,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -12944,9 +13099,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -13171,9 +13327,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -13310,7 +13471,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -13534,12 +13695,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -13556,15 +13717,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -13735,25 +13898,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -13762,9 +13928,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -13809,9 +13976,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -13850,8 +14017,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -13924,8 +14091,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -13951,7 +14118,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -13967,7 +14135,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -13990,7 +14158,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -14029,9 +14197,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -14256,9 +14425,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -14395,7 +14569,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -14619,12 +14793,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -14641,15 +14815,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -14820,25 +14996,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -14847,9 +15026,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -14894,9 +15074,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -14935,8 +15115,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -15009,8 +15189,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -15036,7 +15216,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -15052,7 +15233,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -15075,7 +15256,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -15114,9 +15295,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -15341,9 +15523,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -15480,7 +15667,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -15704,12 +15891,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -15726,15 +15913,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -15905,25 +16094,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -15932,9 +16124,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -15979,9 +16172,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -16020,8 +16213,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -16094,8 +16287,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -16121,7 +16314,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -16137,7 +16331,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -16160,7 +16354,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -16199,9 +16393,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -16426,9 +16621,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -16565,7 +16765,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -16789,12 +16989,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -16811,15 +17011,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -16990,25 +17192,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -17017,9 +17222,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -17064,9 +17270,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -17105,8 +17311,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -17179,8 +17385,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -17206,7 +17412,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -17222,7 +17429,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -17245,7 +17452,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -17284,9 +17491,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -17511,9 +17719,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -17650,7 +17863,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -17874,12 +18087,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -17896,15 +18109,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -18075,25 +18290,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -18102,9 +18320,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -18149,9 +18368,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -18190,8 +18409,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -18264,8 +18483,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -18291,7 +18510,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -18307,7 +18527,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -18330,7 +18550,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -18369,9 +18589,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -18596,9 +18817,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -18735,7 +18961,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -18959,12 +19185,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -18981,15 +19207,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -19160,25 +19388,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -19187,9 +19418,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -19234,9 +19466,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -19275,8 +19507,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -19349,8 +19581,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -19376,7 +19608,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -19392,7 +19625,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -19415,7 +19648,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -19454,9 +19687,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -19681,9 +19915,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -19820,7 +20059,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -20044,12 +20283,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -20066,15 +20305,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -20245,25 +20486,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -20272,9 +20516,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -20319,9 +20564,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -20360,8 +20605,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -20434,8 +20679,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -20461,7 +20706,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -20477,7 +20723,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -20500,7 +20746,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -20539,9 +20785,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -20766,9 +21013,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -20905,7 +21157,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -21129,12 +21381,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -21151,15 +21403,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -21330,25 +21584,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -21357,9 +21614,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -21404,9 +21662,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -21445,8 +21703,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -21519,8 +21777,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -21546,7 +21804,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -21562,7 +21821,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -21585,7 +21844,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -21624,9 +21883,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -21851,9 +22111,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -21990,7 +22255,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -22214,12 +22479,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -22236,15 +22501,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -22415,25 +22682,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -22442,9 +22712,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -22489,9 +22760,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -22530,8 +22801,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -22604,8 +22875,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -22631,7 +22902,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -22647,7 +22919,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -22670,7 +22942,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -22709,9 +22981,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -22936,9 +23209,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -23075,7 +23353,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -23299,12 +23577,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -23321,15 +23599,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -23500,25 +23780,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -23527,9 +23810,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -23574,9 +23858,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -23615,8 +23899,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -23689,8 +23973,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -23716,7 +24000,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -23732,7 +24017,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -23755,7 +24040,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -23794,9 +24079,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -24021,9 +24307,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -24160,7 +24451,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -24384,12 +24675,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -24406,15 +24697,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -24585,25 +24878,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -24612,9 +24908,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -24659,9 +24956,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -24700,8 +24997,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -24774,8 +25071,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -24801,7 +25098,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -24817,7 +25115,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -24840,7 +25138,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -24879,9 +25177,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -25106,9 +25405,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -25245,7 +25549,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -25469,12 +25773,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -25491,15 +25795,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -25670,25 +25976,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -25697,9 +26006,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -25744,9 +26054,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -25785,8 +26095,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -25859,8 +26169,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -25886,7 +26196,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -25902,7 +26213,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -25925,7 +26236,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -25964,9 +26275,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -26191,9 +26503,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -26330,7 +26647,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -26554,12 +26871,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -26576,15 +26893,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -26755,25 +27074,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -26782,9 +27104,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -26829,9 +27152,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -26870,8 +27193,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -26944,8 +27267,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -26971,7 +27294,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -26987,7 +27311,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -27010,7 +27334,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -27049,9 +27373,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -27276,9 +27601,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -27415,7 +27745,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -27639,12 +27969,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -27661,15 +27991,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -27840,25 +28172,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -27867,9 +28202,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -27914,9 +28250,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -27955,8 +28291,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -28029,8 +28365,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -28056,7 +28392,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -28072,7 +28409,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -28095,7 +28432,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -28134,9 +28471,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -28361,9 +28699,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -28500,7 +28843,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -28724,12 +29067,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -28746,15 +29089,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -28925,25 +29270,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -28952,9 +29300,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -28999,9 +29348,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -29040,8 +29389,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -29114,8 +29463,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -29141,7 +29490,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -29157,7 +29507,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -29180,7 +29530,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -29219,9 +29569,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -29446,9 +29797,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -29585,7 +29941,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -29809,12 +30165,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -29831,15 +30187,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -30010,25 +30368,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -30037,9 +30398,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -30084,9 +30446,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -30125,8 +30487,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -30199,8 +30561,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -30226,7 +30588,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -30242,7 +30605,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -30265,7 +30628,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -30304,9 +30667,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -30531,9 +30895,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -30670,7 +31039,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -30894,12 +31263,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -30916,15 +31285,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -31095,25 +31466,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -31122,9 +31496,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -31169,9 +31544,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -31210,8 +31585,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -31284,8 +31659,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -31311,7 +31686,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -31327,7 +31703,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -31350,7 +31726,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -31389,9 +31765,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -31616,9 +31993,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -31755,7 +32137,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -31979,12 +32361,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -32001,15 +32383,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -32180,25 +32564,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -32207,9 +32594,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -32254,9 +32642,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -32295,8 +32683,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -32369,8 +32757,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -32396,7 +32784,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -32412,7 +32801,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -32435,7 +32824,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -32474,9 +32863,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -32701,9 +33091,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -32840,7 +33235,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -33064,12 +33459,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -33086,15 +33481,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -33265,25 +33662,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -33292,9 +33692,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -33339,9 +33740,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -33380,8 +33781,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -33454,8 +33855,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -33481,7 +33882,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -33497,7 +33899,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -33520,7 +33922,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -33559,9 +33961,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -33786,9 +34189,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -33925,7 +34333,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -34149,12 +34557,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -34171,15 +34579,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -34350,25 +34760,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -34377,9 +34790,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -34424,9 +34838,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -34465,8 +34879,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -34539,8 +34953,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -34566,7 +34980,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -34582,7 +34997,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -34605,7 +35020,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -34644,9 +35059,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -34871,9 +35287,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -35010,7 +35431,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -35234,12 +35655,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -35256,15 +35677,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -35435,25 +35858,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -35462,9 +35888,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -35509,9 +35936,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -35550,8 +35977,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -35624,8 +36051,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -35651,7 +36078,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -35667,7 +36095,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -35690,7 +36118,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -35729,9 +36157,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -35956,9 +36385,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -36095,7 +36529,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -36319,12 +36753,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -36341,15 +36775,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -36520,25 +36956,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -36547,9 +36986,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -36594,9 +37034,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -36635,8 +37075,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -36709,8 +37149,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -36736,7 +37176,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -36752,7 +37193,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -36775,7 +37216,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -36814,9 +37255,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -37041,9 +37483,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -37180,7 +37627,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -37404,12 +37851,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -37426,15 +37873,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -37605,25 +38054,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -37632,9 +38084,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -37679,9 +38132,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -37720,8 +38173,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -37794,8 +38247,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -37821,7 +38274,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -37837,7 +38291,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -37860,7 +38314,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -37899,9 +38353,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -38126,9 +38581,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -38265,7 +38725,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -38489,12 +38949,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -38511,15 +38971,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -38690,25 +39152,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -38717,9 +39182,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -38764,9 +39230,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -38805,8 +39271,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -38879,8 +39345,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -38906,7 +39372,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -38922,7 +39389,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -38945,7 +39412,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -38984,9 +39451,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -39211,9 +39679,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -39350,7 +39823,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -39574,12 +40047,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -39596,15 +40069,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -39775,25 +40250,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -39802,9 +40280,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -39849,9 +40328,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -39890,8 +40369,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -39964,8 +40443,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -39991,7 +40470,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -40007,7 +40487,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -40030,7 +40510,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -40069,9 +40549,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -40296,9 +40777,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -40435,7 +40921,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -40659,12 +41145,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -40681,15 +41167,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -40860,25 +41348,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -40887,9 +41378,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -40934,9 +41426,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -40975,8 +41467,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -41049,8 +41541,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -41076,7 +41568,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -41092,7 +41585,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -41115,7 +41608,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -41154,9 +41647,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -41381,9 +41875,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -41520,7 +42019,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -41744,12 +42243,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -41766,15 +42265,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -41945,25 +42446,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -41972,9 +42476,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -42019,9 +42524,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -42060,8 +42565,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -42134,8 +42639,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -42161,7 +42666,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -42177,7 +42683,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -42200,7 +42706,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -42239,9 +42745,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -42466,9 +42973,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -42605,7 +43117,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -42829,12 +43341,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -42851,15 +43363,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -43030,25 +43544,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -43057,9 +43574,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -43104,9 +43622,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -43145,8 +43663,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -43219,8 +43737,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -43246,7 +43764,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -43262,7 +43781,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -43285,7 +43804,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -43324,9 +43843,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -43551,9 +44071,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -43690,7 +44215,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -43914,12 +44439,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -43936,15 +44461,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -44115,25 +44642,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -44142,9 +44672,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -44189,9 +44720,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -44230,8 +44761,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -44304,8 +44835,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -44331,7 +44862,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -44347,7 +44879,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -44370,7 +44902,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -44409,9 +44941,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -44636,9 +45169,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -44775,7 +45313,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -44999,12 +45537,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -45021,15 +45559,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -45200,25 +45740,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -45227,9 +45770,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -45274,9 +45818,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -45315,8 +45859,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -45389,8 +45933,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -45416,7 +45960,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -45432,7 +45977,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -45455,7 +46000,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -45494,9 +46039,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -45721,9 +46267,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -45860,7 +46411,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -46084,12 +46635,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -46106,15 +46657,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -46285,25 +46838,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -46312,9 +46868,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -46359,9 +46916,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -46400,8 +46957,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -46474,8 +47031,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -46501,7 +47058,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -46517,7 +47075,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -46540,7 +47098,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -46579,9 +47137,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -46806,9 +47365,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -46945,7 +47509,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -47169,12 +47733,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -47191,15 +47755,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -47370,25 +47936,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -47397,9 +47966,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -47444,9 +48014,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -47485,8 +48055,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -47559,8 +48129,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -47586,7 +48156,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -47602,7 +48173,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -47625,7 +48196,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -47664,9 +48235,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -47891,9 +48463,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -48030,7 +48607,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -48254,12 +48831,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -48276,15 +48853,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -48455,25 +49034,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -48482,9 +49064,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -48529,9 +49112,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -48570,8 +49153,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -48644,8 +49227,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -48671,7 +49254,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -48687,7 +49271,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -48710,7 +49294,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -48749,9 +49333,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -48976,9 +49561,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -49115,7 +49705,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -49339,12 +49929,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -49361,15 +49951,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -49540,25 +50132,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -49567,9 +50162,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -49614,9 +50210,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -49655,8 +50251,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -49729,8 +50325,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -49756,7 +50352,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -49772,7 +50369,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -49795,7 +50392,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -49834,9 +50431,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -50061,9 +50659,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -50200,7 +50803,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -50424,12 +51027,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -50446,15 +51049,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -50625,25 +51230,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -50652,9 +51260,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -50699,9 +51308,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -50740,8 +51349,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -50814,8 +51423,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -50841,7 +51450,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -50857,7 +51467,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -50880,7 +51490,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -50919,9 +51529,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -51146,9 +51757,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -51285,7 +51901,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -51509,12 +52125,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -51531,15 +52147,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -51710,25 +52328,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -51737,9 +52358,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -51784,9 +52406,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -51825,8 +52447,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -51899,8 +52521,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -51926,7 +52548,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -51942,7 +52565,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -51965,7 +52588,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -52004,9 +52627,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -52231,9 +52855,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -52370,7 +52999,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -52594,12 +53223,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -52616,15 +53245,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -52795,25 +53426,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -52822,9 +53456,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -52869,9 +53504,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -52910,8 +53545,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -52984,8 +53619,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -53011,7 +53646,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -53027,7 +53663,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -53050,7 +53686,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -53089,9 +53725,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -53316,9 +53953,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -53455,7 +54097,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -53679,12 +54321,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -53701,15 +54343,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -53880,25 +54524,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -53907,9 +54554,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -53954,9 +54602,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -53995,8 +54643,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -54069,8 +54717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -54096,7 +54744,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -54112,7 +54761,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -54135,7 +54784,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -54174,9 +54823,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -54401,9 +55051,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -54540,7 +55195,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -54764,12 +55419,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -54786,15 +55441,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -54965,25 +55622,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -54992,9 +55652,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -55039,9 +55700,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -55080,8 +55741,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -55154,8 +55815,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -55181,7 +55842,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -55197,7 +55859,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -55220,7 +55882,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -55259,9 +55921,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -55486,9 +56149,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -55625,7 +56293,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -55849,12 +56517,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -55871,15 +56539,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -56050,25 +56720,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -56077,9 +56750,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -56124,9 +56798,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -56165,8 +56839,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -56239,8 +56913,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -56266,7 +56940,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -56282,7 +56957,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -56305,7 +56980,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -56344,9 +57019,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -56571,9 +57247,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -56710,7 +57391,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -56934,12 +57615,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -56956,15 +57637,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -57135,25 +57818,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -57162,9 +57848,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -57209,9 +57896,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -57250,8 +57937,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -57324,8 +58011,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -57351,7 +58038,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -57367,7 +58055,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -57390,7 +58078,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -57429,9 +58117,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -57656,9 +58345,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -57795,7 +58489,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -58019,12 +58713,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -58041,15 +58735,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -58220,25 +58916,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -58247,9 +58946,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -58294,9 +58994,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -58335,8 +59035,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -58409,8 +59109,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -58436,7 +59136,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -58452,7 +59153,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -58475,7 +59176,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -58514,9 +59215,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -58741,9 +59443,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -58880,7 +59587,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -59104,12 +59811,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -59126,15 +59833,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -59305,25 +60014,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -59332,9 +60044,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -59379,9 +60092,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -59420,8 +60133,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -59494,8 +60207,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -59521,7 +60234,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -59537,7 +60251,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -59560,7 +60274,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -59599,9 +60313,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -59826,9 +60541,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -59965,7 +60685,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -60189,12 +60909,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -60211,15 +60931,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -60390,25 +61112,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -60417,9 +61142,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -60464,9 +61190,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -60505,8 +61231,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -60579,8 +61305,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -60606,7 +61332,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -60622,7 +61349,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -60645,7 +61372,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -60684,9 +61411,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -60911,9 +61639,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -61050,7 +61783,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -61274,12 +62007,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -61296,15 +62029,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -61475,25 +62210,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -61502,9 +62240,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -61549,9 +62288,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -61590,8 +62329,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -61664,8 +62403,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -61691,7 +62430,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -61707,7 +62447,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -61730,7 +62470,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -61769,9 +62509,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -61996,9 +62737,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -62135,7 +62881,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -62359,12 +63105,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -62381,15 +63127,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -62560,25 +63308,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -62587,9 +63338,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -62634,9 +63386,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -62675,8 +63427,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -62749,8 +63501,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -62776,7 +63528,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -62792,7 +63545,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -62815,7 +63568,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -62854,9 +63607,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -63081,9 +63835,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -63220,7 +63979,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -63444,12 +64203,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -63466,15 +64225,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -63645,25 +64406,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -63672,9 +64436,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -63719,9 +64484,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -63760,8 +64525,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -63834,8 +64599,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -63861,7 +64626,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -63877,7 +64643,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -63900,7 +64666,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -63939,9 +64705,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -64166,9 +64933,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -64305,7 +65077,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -64529,12 +65301,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -64551,15 +65323,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -64730,25 +65504,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -64757,9 +65534,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -64804,9 +65582,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -64845,8 +65623,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -64919,8 +65697,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -64946,7 +65724,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -64962,7 +65741,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -64985,7 +65764,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -65024,9 +65803,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -65251,9 +66031,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -65390,7 +66175,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -65614,12 +66399,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -65636,15 +66421,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -65815,25 +66602,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -65842,9 +66632,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -65889,9 +66680,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -65930,8 +66721,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -66004,8 +66795,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -66031,7 +66822,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -66047,7 +66839,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -66070,7 +66862,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -66109,9 +66901,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -66336,9 +67129,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -66475,7 +67273,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -66699,12 +67497,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -66721,15 +67519,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -66900,25 +67700,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -66927,9 +67730,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -66974,9 +67778,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -67015,8 +67819,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -67089,8 +67893,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -67116,7 +67920,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -67132,7 +67937,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -67155,7 +67960,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -67194,9 +67999,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -67421,9 +68227,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -67560,7 +68371,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -67784,12 +68595,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -67806,15 +68617,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -67985,25 +68798,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -68012,9 +68828,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -68059,9 +68876,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -68100,8 +68917,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -68174,8 +68991,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -68201,7 +69018,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -68217,7 +69035,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -68240,7 +69058,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -68279,9 +69097,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -68506,9 +69325,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -68645,7 +69469,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -68869,12 +69693,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -68891,15 +69715,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -69070,25 +69896,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -69097,9 +69926,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -69144,9 +69974,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -69185,8 +70015,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -69259,8 +70089,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -69286,7 +70116,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -69302,7 +70133,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -69325,7 +70156,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -69364,9 +70195,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -69591,9 +70423,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -69730,7 +70567,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -69954,12 +70791,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -69976,15 +70813,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -70155,25 +70994,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -70182,9 +71024,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -70229,9 +71072,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -70270,8 +71113,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -70344,8 +71187,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -70371,7 +71214,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -70387,7 +71231,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -70410,7 +71254,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -70449,9 +71293,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -70676,9 +71521,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -70815,7 +71665,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -71039,12 +71889,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -71061,15 +71911,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -71240,25 +72092,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -71267,9 +72122,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -71314,9 +72170,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -71355,8 +72211,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -71429,8 +72285,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -71456,7 +72312,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -71472,7 +72329,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -71495,7 +72352,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -71534,9 +72391,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -71761,9 +72619,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -71900,7 +72763,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -72124,12 +72987,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -72146,15 +73009,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -72325,25 +73190,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -72352,9 +73220,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -72399,9 +73268,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -72440,8 +73309,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -72514,8 +73383,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -72541,7 +73410,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -72557,7 +73427,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -72580,7 +73450,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -72619,9 +73489,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -72846,9 +73717,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -72985,7 +73861,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -73209,12 +74085,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -73231,15 +74107,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -73410,25 +74288,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -73437,9 +74318,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -73484,9 +74366,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -73525,8 +74407,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -73599,8 +74481,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -73626,7 +74508,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -73642,7 +74525,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -73665,7 +74548,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -73704,9 +74587,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -73931,9 +74815,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -74070,7 +74959,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -74294,12 +75183,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -74316,15 +75205,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -74495,25 +75386,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -74522,9 +75416,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -74569,9 +75464,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -74610,8 +75505,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -74684,8 +75579,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -74711,7 +75606,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -74727,7 +75623,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -74750,7 +75646,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -74789,9 +75685,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -75016,9 +75913,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -75155,7 +76057,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -75379,12 +76281,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -75401,15 +76303,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -75580,25 +76484,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -75607,9 +76514,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -75654,9 +76562,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -75695,8 +76603,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -75769,8 +76677,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -75796,7 +76704,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -75812,7 +76721,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -75835,7 +76744,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -75874,9 +76783,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -76101,9 +77011,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -76240,7 +77155,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -76464,12 +77379,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -76486,15 +77401,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -76665,25 +77582,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -76692,9 +77612,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -76739,9 +77660,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -76780,8 +77701,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -76854,8 +77775,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -76881,7 +77802,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -76897,7 +77819,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -76920,7 +77842,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -76959,9 +77881,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -77186,9 +78109,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -77325,7 +78253,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -77549,12 +78477,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -77571,15 +78499,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -77750,25 +78680,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -77777,9 +78710,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -77824,9 +78758,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -77865,8 +78799,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -77939,8 +78873,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -77966,7 +78900,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -77982,7 +78917,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -78005,7 +78940,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -78044,9 +78979,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -78271,9 +79207,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -78410,7 +79351,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -78634,12 +79575,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -78656,15 +79597,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -78835,25 +79778,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -78862,9 +79808,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -78909,9 +79856,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -78950,8 +79897,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -79024,8 +79971,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -79051,7 +79998,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -79067,7 +80015,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -79090,7 +80038,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -79129,9 +80077,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -79356,9 +80305,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -79495,7 +80449,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -79719,12 +80673,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -79741,15 +80695,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -79920,25 +80876,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -79947,9 +80906,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -79994,9 +80954,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -80035,8 +80995,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -80109,8 +81069,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -80136,7 +81096,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -80152,7 +81113,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -80175,7 +81136,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -80214,9 +81175,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -80441,9 +81403,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -80580,7 +81547,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -80804,12 +81771,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -80826,15 +81793,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -81005,25 +81974,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -81032,9 +82004,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -81079,9 +82052,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -81120,8 +82093,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -81194,8 +82167,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -81221,7 +82194,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -81237,7 +82211,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -81260,7 +82234,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -81299,9 +82273,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -81526,9 +82501,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -81665,7 +82645,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -81889,12 +82869,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -81911,15 +82891,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -82090,25 +83072,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -82117,9 +83102,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -82164,9 +83150,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -82205,8 +83191,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -82279,8 +83265,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -82306,7 +83292,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -82322,7 +83309,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -82345,7 +83332,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -82384,9 +83371,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -82611,9 +83599,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -82750,7 +83743,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -82974,12 +83967,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -82996,15 +83989,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -83175,25 +84170,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -83202,9 +84200,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -83249,9 +84248,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -83290,8 +84289,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -83364,8 +84363,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -83391,7 +84390,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -83407,7 +84407,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -83430,7 +84430,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -83469,9 +84469,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -83696,9 +84697,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -83835,7 +84841,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -84059,12 +85065,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -84081,15 +85087,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -84260,25 +85268,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -84287,9 +85298,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -84334,9 +85346,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -84375,8 +85387,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -84449,8 +85461,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -84476,7 +85488,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -84492,7 +85505,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -84515,7 +85528,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -84554,9 +85567,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -84781,9 +85795,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -84920,7 +85939,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -85144,12 +86163,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -85166,15 +86185,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -85345,25 +86366,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -85372,9 +86396,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -85419,9 +86444,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -85460,8 +86485,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -85534,8 +86559,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -85561,7 +86586,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -85577,7 +86603,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -85600,7 +86626,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -85639,9 +86665,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -85866,9 +86893,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -86005,7 +87037,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -86229,12 +87261,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -86251,15 +87283,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -86430,25 +87464,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -86457,9 +87494,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -86504,9 +87542,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -86545,8 +87583,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -86619,8 +87657,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -86646,7 +87684,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -86662,7 +87701,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -86685,7 +87724,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -86724,9 +87763,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -86951,9 +87991,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -87090,7 +88135,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -87314,12 +88359,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -87336,15 +88381,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -87515,25 +88562,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -87542,9 +88592,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -87589,9 +88640,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -87630,8 +88681,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -87704,8 +88755,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -87731,7 +88782,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -87747,7 +88799,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -87770,7 +88822,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -87809,9 +88861,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -88036,9 +89089,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -88175,7 +89233,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -88399,12 +89457,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -88421,15 +89479,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -88600,25 +89660,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -88627,9 +89690,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -88674,9 +89738,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -88715,8 +89779,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -88789,8 +89853,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -88816,7 +89880,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -88832,7 +89897,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -88855,7 +89920,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -88894,9 +89959,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -89121,9 +90187,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -89260,7 +90331,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -89484,12 +90555,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -89506,15 +90577,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -89685,25 +90758,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -89712,9 +90788,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -89759,9 +90836,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -89800,8 +90877,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -89874,8 +90951,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -89901,7 +90978,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -89917,7 +90995,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -89940,7 +91018,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -89979,9 +91057,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -90206,9 +91285,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -90345,7 +91429,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -90569,12 +91653,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -90591,15 +91675,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -90770,25 +91856,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -90797,9 +91886,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -90844,9 +91934,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -90885,8 +91975,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -90959,8 +92049,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -90986,7 +92076,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -91002,7 +92093,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -91025,7 +92116,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -91064,9 +92155,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -91291,9 +92383,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -91430,7 +92527,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -91654,12 +92751,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -91676,15 +92773,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -91855,25 +92954,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -91882,9 +92984,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -91929,9 +93032,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -91970,8 +93073,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -92044,8 +93147,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -92071,7 +93174,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -92087,7 +93191,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -92110,7 +93214,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -92149,9 +93253,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -92376,9 +93481,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -92515,7 +93625,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -92739,12 +93849,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -92761,15 +93871,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -92940,25 +94052,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -92967,9 +94082,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -93014,9 +94130,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -93055,8 +94171,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -93129,8 +94245,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -93156,7 +94272,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -93172,7 +94289,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -93195,7 +94312,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -93234,9 +94351,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -93461,9 +94579,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -93600,7 +94723,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -93824,12 +94947,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -93846,15 +94969,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -94025,25 +95150,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -94052,9 +95180,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -94099,9 +95228,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -94140,8 +95269,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -94214,8 +95343,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -94241,7 +95370,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -94257,7 +95387,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -94280,7 +95410,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -94319,9 +95449,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -94546,9 +95677,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -94685,7 +95821,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -94909,12 +96045,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -94931,15 +96067,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -95110,25 +96248,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -95137,9 +96278,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -95184,9 +96326,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -95225,8 +96367,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -95299,8 +96441,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -95326,7 +96468,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -95342,7 +96485,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -95365,7 +96508,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -95404,9 +96547,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -95631,9 +96775,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -95770,7 +96919,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -95994,12 +97143,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -96016,15 +97165,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -96195,25 +97346,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -96222,9 +97376,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -96269,9 +97424,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -96310,8 +97465,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -96384,8 +97539,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -96411,7 +97566,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -96427,7 +97583,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -96450,7 +97606,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -96489,9 +97645,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -96716,9 +97873,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -96855,7 +98017,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -97079,12 +98241,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -97101,15 +98263,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -97280,25 +98444,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -97307,9 +98474,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -97354,9 +98522,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -97395,8 +98563,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -97469,8 +98637,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -97496,7 +98664,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -97512,7 +98681,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -97535,7 +98704,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -97574,9 +98743,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -97801,9 +98971,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -97940,7 +99115,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -98164,12 +99339,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -98186,15 +99361,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -98365,25 +99542,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -98392,9 +99572,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -98439,9 +99620,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -98480,8 +99661,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -98554,8 +99735,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -98581,7 +99762,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -98597,7 +99779,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -98620,7 +99802,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -98659,9 +99841,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -98886,9 +100069,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -99025,7 +100213,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -99249,12 +100437,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -99271,15 +100459,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -99450,25 +100640,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -99477,9 +100670,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -99524,9 +100718,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -99565,8 +100759,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -99639,8 +100833,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -99666,7 +100860,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -99682,7 +100877,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -99705,7 +100900,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -99744,9 +100939,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -99971,9 +101167,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -100110,7 +101311,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -100334,12 +101535,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -100356,15 +101557,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -100535,25 +101738,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -100562,9 +101768,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -100609,9 +101816,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -100650,8 +101857,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -100724,8 +101931,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -100751,7 +101958,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -100767,7 +101975,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -100790,7 +101998,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -100829,9 +102037,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -101056,9 +102265,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -101195,7 +102409,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -101419,12 +102633,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -101441,15 +102655,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -101620,25 +102836,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -101647,9 +102866,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -101694,9 +102914,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -101735,8 +102955,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -101809,8 +103029,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -101836,7 +103056,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -101852,7 +103073,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -101875,7 +103096,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -101914,9 +103135,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -102141,9 +103363,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -102280,7 +103507,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -102504,12 +103731,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -102526,15 +103753,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -102705,25 +103934,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -102732,9 +103964,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -102779,9 +104012,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -102820,8 +104053,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -102894,8 +104127,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -102921,7 +104154,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -102937,7 +104171,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -102960,7 +104194,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -102999,9 +104233,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -103226,9 +104461,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -103365,7 +104605,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -103589,12 +104829,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -103611,15 +104851,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -103790,25 +105032,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -103817,9 +105062,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -103864,9 +105110,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -103905,8 +105151,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -103979,8 +105225,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -104006,7 +105252,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -104022,7 +105269,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -104045,7 +105292,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -104084,9 +105331,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -104311,9 +105559,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -104450,7 +105703,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -104674,12 +105927,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -104696,15 +105949,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -104875,25 +106130,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -104902,9 +106160,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -104949,9 +106208,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -104990,8 +106249,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -105064,8 +106323,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -105091,7 +106350,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -105107,7 +106367,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -105130,7 +106390,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -105169,9 +106429,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -105396,9 +106657,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -105535,7 +106801,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -105759,12 +107025,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -105781,15 +107047,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -105960,25 +107228,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -105987,9 +107258,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -106034,9 +107306,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -106075,8 +107347,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -106149,8 +107421,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -106176,7 +107448,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -106192,7 +107465,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -106215,7 +107488,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -106254,9 +107527,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -106481,9 +107755,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -106620,7 +107899,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -106844,12 +108123,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -106866,15 +108145,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -107045,25 +108326,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -107072,9 +108356,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -107119,9 +108404,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -107160,8 +108445,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -107234,8 +108519,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -107261,7 +108546,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -107277,7 +108563,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -107300,7 +108586,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -107339,9 +108625,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -107566,9 +108853,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -107705,7 +108997,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -107929,12 +109221,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -107951,15 +109243,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -108130,25 +109424,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -108157,9 +109454,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -108204,9 +109502,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -108245,8 +109543,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -108319,8 +109617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -108346,7 +109644,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -108362,7 +109661,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -108385,7 +109684,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -108424,9 +109723,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -108651,9 +109951,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -108790,7 +110095,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -109014,12 +110319,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -109036,15 +110341,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -109215,25 +110522,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -109242,9 +110552,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -109289,9 +110600,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -109330,8 +110641,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -109404,8 +110715,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -109431,7 +110742,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -109447,7 +110759,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -109470,7 +110782,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -109509,9 +110821,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -109736,9 +111049,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -109875,7 +111193,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -110099,12 +111417,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -110121,15 +111439,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -110300,25 +111620,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -110327,9 +111650,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -110374,9 +111698,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -110415,8 +111739,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -110489,8 +111813,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -110516,7 +111840,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -110532,7 +111857,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -110555,7 +111880,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -110594,9 +111919,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -110821,9 +112147,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -110960,7 +112291,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -111184,12 +112515,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -111206,15 +112537,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -111385,25 +112718,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -111412,9 +112748,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -111459,9 +112796,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -111500,8 +112837,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -111574,8 +112911,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -111601,7 +112938,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -111617,7 +112955,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -111640,7 +112978,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -111679,9 +113017,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -111906,9 +113245,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -112045,7 +113389,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -112269,12 +113613,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -112291,15 +113635,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -112470,25 +113816,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -112497,9 +113846,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -112544,9 +113894,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -112585,8 +113935,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -112659,8 +114009,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -112686,7 +114036,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -112702,7 +114053,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -112725,7 +114076,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -112764,9 +114115,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -112991,9 +114343,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -113130,7 +114487,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -113354,12 +114711,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -113376,15 +114733,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -113555,25 +114914,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -113582,9 +114944,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -113629,9 +114992,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -113670,8 +115033,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -113744,8 +115107,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -113771,7 +115134,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -113787,7 +115151,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -113810,7 +115174,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -113849,9 +115213,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -114076,9 +115441,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -114215,7 +115585,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -114439,12 +115809,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -114461,15 +115831,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -114640,25 +116012,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -114667,9 +116042,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -114714,9 +116090,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -114755,8 +116131,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -114829,8 +116205,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -114856,7 +116232,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -114872,7 +116249,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -114895,7 +116272,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -114934,9 +116311,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -115161,9 +116539,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -115300,7 +116683,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -115524,12 +116907,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -115546,15 +116929,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -115725,25 +117110,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -115752,9 +117140,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -115799,9 +117188,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -115840,8 +117229,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -115914,8 +117303,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -115941,7 +117330,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -115957,7 +117347,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -115980,7 +117370,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -116019,9 +117409,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -116246,9 +117637,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -116385,7 +117781,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -116609,12 +118005,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -116631,15 +118027,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -116810,25 +118208,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -116837,9 +118238,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -116884,9 +118286,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -116925,8 +118327,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -116999,8 +118401,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -117026,7 +118428,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -117042,7 +118445,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -117065,7 +118468,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -117104,9 +118507,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -117331,9 +118735,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -117470,7 +118879,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -117694,12 +119103,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -117716,15 +119125,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -117895,25 +119306,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -117922,9 +119336,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -117969,9 +119384,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -118010,8 +119425,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -118084,8 +119499,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -118111,7 +119526,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -118127,7 +119543,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -118150,7 +119566,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -118189,9 +119605,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -118416,9 +119833,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -118555,7 +119977,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -118779,12 +120201,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -118801,15 +120223,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -118980,25 +120404,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -119007,9 +120434,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -119054,9 +120482,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -119095,8 +120523,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -119169,8 +120597,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -119196,7 +120624,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -119212,7 +120641,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -119235,7 +120664,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -119274,9 +120703,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -119501,9 +120931,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -119640,7 +121075,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -119864,12 +121299,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -119886,15 +121321,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -120065,25 +121502,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -120092,9 +121532,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -120139,9 +121580,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -120180,8 +121621,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -120254,8 +121695,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -120281,7 +121722,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -120297,7 +121739,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -120320,7 +121762,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -120359,9 +121801,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -120586,9 +122029,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -120725,7 +122173,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -120949,12 +122397,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -120971,15 +122419,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -121150,25 +122600,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -121177,9 +122630,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -121224,9 +122678,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -121265,8 +122719,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -121339,8 +122793,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -121366,7 +122820,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -121382,7 +122837,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -121405,7 +122860,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -121444,9 +122899,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -121671,9 +123127,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -121810,7 +123271,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -122034,12 +123495,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -122056,15 +123517,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -122235,25 +123698,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -122262,9 +123728,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -122309,9 +123776,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -122350,8 +123817,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -122424,8 +123891,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -122451,7 +123918,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -122467,7 +123935,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -122490,7 +123958,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -122529,9 +123997,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -122756,9 +124225,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -122895,7 +124369,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -123119,12 +124593,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -123141,15 +124615,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -123320,25 +124796,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -123347,9 +124826,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -123394,9 +124874,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -123435,8 +124915,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -123509,8 +124989,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -123536,7 +125016,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -123552,7 +125033,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -123575,7 +125056,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -123614,9 +125095,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -123841,9 +125323,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -123980,7 +125467,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -124204,12 +125691,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -124226,15 +125713,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -124405,25 +125894,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -124432,9 +125924,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -124479,9 +125972,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -124520,8 +126013,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -124594,8 +126087,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -124621,7 +126114,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -124637,7 +126131,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -124660,7 +126154,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -124699,9 +126193,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -124926,9 +126421,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -125065,7 +126565,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -125289,12 +126789,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -125311,15 +126811,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -125490,25 +126992,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -125517,9 +127022,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -125564,9 +127070,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -125605,8 +127111,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -125679,8 +127185,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -125706,7 +127212,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -125722,7 +127229,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -125745,7 +127252,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -125784,9 +127291,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -126011,9 +127519,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -126150,7 +127663,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -126374,12 +127887,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -126396,15 +127909,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -126575,25 +128090,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -126602,9 +128120,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -126649,9 +128168,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -126690,8 +128209,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -126764,8 +128283,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -126791,7 +128310,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -126807,7 +128327,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -126830,7 +128350,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -126869,9 +128389,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -127096,9 +128617,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -127235,7 +128761,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -127459,12 +128985,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -127481,15 +129007,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -127660,25 +129188,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -127687,9 +129218,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -127734,9 +129266,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -127775,8 +129307,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -127849,8 +129381,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -127876,7 +129408,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -127892,7 +129425,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -127915,7 +129448,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -127954,9 +129487,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -128181,9 +129715,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -128320,7 +129859,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -128544,12 +130083,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -128566,15 +130105,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -128745,25 +130286,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -128772,9 +130316,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -128819,9 +130364,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -128860,8 +130405,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -128934,8 +130479,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -128961,7 +130506,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -128977,7 +130523,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -129000,7 +130546,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -129039,9 +130585,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -129266,9 +130813,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -129405,7 +130957,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -129629,12 +131181,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -129651,15 +131203,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -129830,25 +131384,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -129857,9 +131414,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -129904,9 +131462,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -129945,8 +131503,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -130019,8 +131577,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -130046,7 +131604,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -130062,7 +131621,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -130085,7 +131644,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -130124,9 +131683,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -130351,9 +131911,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -130490,7 +132055,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -130714,12 +132279,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -130736,15 +132301,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -130915,25 +132482,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -130942,9 +132512,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -130989,9 +132560,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -131030,8 +132601,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -131104,8 +132675,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -131131,7 +132702,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -131147,7 +132719,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -131170,7 +132742,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -131209,9 +132781,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -131436,9 +133009,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -131575,7 +133153,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -131799,12 +133377,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -131821,15 +133399,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -132000,25 +133580,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -132027,9 +133610,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -132074,9 +133658,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -132115,8 +133699,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -132189,8 +133773,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -132216,7 +133800,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -132232,7 +133817,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -132255,7 +133840,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -132294,9 +133879,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -132521,9 +134107,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -132660,7 +134251,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -132884,12 +134475,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -132906,15 +134497,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -133085,25 +134678,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -133112,9 +134708,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -133159,9 +134756,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -133200,8 +134797,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -133274,8 +134871,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -133301,7 +134898,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -133317,7 +134915,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -133340,7 +134938,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -133379,9 +134977,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -133606,9 +135205,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -133745,7 +135349,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -133969,12 +135573,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -133991,15 +135595,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -134170,25 +135776,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -134197,9 +135806,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -134244,9 +135854,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -134285,8 +135895,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -134359,8 +135969,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -134386,7 +135996,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -134402,7 +136013,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -134425,7 +136036,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -134464,9 +136075,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -134691,9 +136303,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -134830,7 +136447,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -135054,12 +136671,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -135076,15 +136693,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -135255,25 +136874,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -135282,9 +136904,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -135329,9 +136952,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -135370,8 +136993,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -135444,8 +137067,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -135471,7 +137094,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -135487,7 +137111,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -135510,7 +137134,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -135549,9 +137173,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -135776,9 +137401,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -135915,7 +137545,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -136139,12 +137769,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -136161,15 +137791,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -136340,25 +137972,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -136367,9 +138002,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -136414,9 +138050,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -136455,8 +138091,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -136529,8 +138165,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -136556,7 +138192,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -136572,7 +138209,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -136595,7 +138232,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -136634,9 +138271,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -136861,9 +138499,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -137000,7 +138643,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -137224,12 +138867,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -137246,15 +138889,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -137425,25 +139070,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -137452,9 +139100,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -137499,9 +139148,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -137540,8 +139189,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -137614,8 +139263,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -137641,7 +139290,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -137657,7 +139307,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -137680,7 +139330,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -137719,9 +139369,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -137946,9 +139597,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -138085,7 +139741,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -138309,12 +139965,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -138331,15 +139987,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -138510,25 +140168,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -138537,9 +140198,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -138584,9 +140246,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -138625,8 +140287,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -138699,8 +140361,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -138726,7 +140388,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -138742,7 +140405,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -138765,7 +140428,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -138804,9 +140467,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -139031,9 +140695,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -139170,7 +140839,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -139394,12 +141063,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -139416,15 +141085,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -139595,25 +141266,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -139622,9 +141296,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -139669,9 +141344,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -139710,8 +141385,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -139784,8 +141459,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -139811,7 +141486,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -139827,7 +141503,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -139850,7 +141526,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -139889,9 +141565,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -140116,9 +141793,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -140255,7 +141937,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -140479,12 +142161,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -140501,15 +142183,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -140680,25 +142364,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -140707,9 +142394,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -140754,9 +142442,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -140795,8 +142483,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -140869,8 +142557,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -140896,7 +142584,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -140912,7 +142601,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -140935,7 +142624,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -140974,9 +142663,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -141201,9 +142891,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -141340,7 +143035,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -141564,12 +143259,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -141586,15 +143281,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -141765,25 +143462,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -141792,9 +143492,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -141839,9 +143540,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -141880,8 +143581,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -141954,8 +143655,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -141981,7 +143682,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -141997,7 +143699,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -142020,7 +143722,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -142059,9 +143761,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -142286,9 +143989,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -142425,7 +144133,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -142649,12 +144357,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -142671,15 +144379,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -142850,25 +144560,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -142877,9 +144590,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -142924,9 +144638,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -142965,8 +144679,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -143039,8 +144753,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -143066,7 +144780,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -143082,7 +144797,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -143105,7 +144820,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -143144,9 +144859,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -143371,9 +145087,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -143510,7 +145231,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -143734,12 +145455,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -143756,15 +145477,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -143935,25 +145658,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -143962,9 +145688,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -144009,9 +145736,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -144050,8 +145777,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -144124,8 +145851,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -144151,7 +145878,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -144167,7 +145895,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -144190,7 +145918,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -144229,9 +145957,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -144456,9 +146185,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -144595,7 +146329,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -144819,12 +146553,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -144841,15 +146575,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -145020,25 +146756,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -145047,9 +146786,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -145094,9 +146834,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -145135,8 +146875,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -145209,8 +146949,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -145236,7 +146976,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -145252,7 +146993,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -145275,7 +147016,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -145314,9 +147055,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -145541,9 +147283,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -145680,7 +147427,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -145904,12 +147651,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -145926,15 +147673,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -146105,25 +147854,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -146132,9 +147884,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -146179,9 +147932,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -146220,8 +147973,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -146294,8 +148047,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -146321,7 +148074,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -146337,7 +148091,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -146360,7 +148114,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -146399,9 +148153,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -146626,9 +148381,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -146765,7 +148525,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -146989,12 +148749,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -147011,15 +148771,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -147190,25 +148952,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -147217,9 +148982,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -147264,9 +149030,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -147305,8 +149071,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -147379,8 +149145,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -147406,7 +149172,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -147422,7 +149189,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -147445,7 +149212,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -147484,9 +149251,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -147711,9 +149479,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -147850,7 +149623,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -148074,12 +149847,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -148096,15 +149869,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -148275,25 +150050,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -148302,9 +150080,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -148349,9 +150128,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -148390,8 +150169,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -148464,8 +150243,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -148491,7 +150270,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -148507,7 +150287,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -148530,7 +150310,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -148569,9 +150349,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -148796,9 +150577,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -148935,7 +150721,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -149159,12 +150945,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -149181,15 +150967,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -149360,25 +151148,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -149387,9 +151178,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -149434,9 +151226,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -149475,8 +151267,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -149549,8 +151341,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -149576,7 +151368,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -149592,7 +151385,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -149615,7 +151408,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -149654,9 +151447,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -149881,9 +151675,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -150020,7 +151819,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -150244,12 +152043,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -150266,15 +152065,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -150445,25 +152246,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -150472,9 +152276,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -150519,9 +152324,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -150560,8 +152365,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -150634,8 +152439,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -150661,7 +152466,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -150677,7 +152483,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -150700,7 +152506,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -150739,9 +152545,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -150966,9 +152773,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -151105,7 +152917,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -151329,12 +153141,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -151351,15 +153163,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -151530,25 +153344,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -151557,9 +153374,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -151604,9 +153422,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -151645,8 +153463,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -151719,8 +153537,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -151746,7 +153564,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -151762,7 +153581,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -151785,7 +153604,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -151824,9 +153643,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -152051,9 +153871,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -152190,7 +154015,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -152414,12 +154239,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -152436,15 +154261,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -152615,25 +154442,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -152642,9 +154472,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -152689,9 +154520,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -152730,8 +154561,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -152804,8 +154635,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -152831,7 +154662,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -152847,7 +154679,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -152870,7 +154702,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -152909,9 +154741,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -153136,9 +154969,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -153275,7 +155113,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -153499,12 +155337,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -153521,15 +155359,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -153700,25 +155540,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -153727,9 +155570,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -153774,9 +155618,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -153815,8 +155659,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -153889,8 +155733,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -153916,7 +155760,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -153932,7 +155777,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -153955,7 +155800,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -153994,9 +155839,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -154221,9 +156067,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -154360,7 +156211,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -154584,12 +156435,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -154606,15 +156457,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -154785,25 +156638,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -154812,9 +156668,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -154859,9 +156716,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -154900,8 +156757,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -154974,8 +156831,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -155001,7 +156858,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -155017,7 +156875,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -155040,7 +156898,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -155079,9 +156937,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -155306,9 +157165,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -155445,7 +157309,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -155669,12 +157533,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -155691,15 +157555,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -155870,25 +157736,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -155897,9 +157766,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -155944,9 +157814,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -155985,8 +157855,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -156059,8 +157929,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -156086,7 +157956,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -156102,7 +157973,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -156125,7 +157996,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -156164,9 +158035,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -156391,9 +158263,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -156530,7 +158407,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -156754,12 +158631,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -156776,15 +158653,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -156955,25 +158834,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -156982,9 +158864,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -157029,9 +158912,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -157070,8 +158953,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -157144,8 +159027,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -157171,7 +159054,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -157187,7 +159071,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -157210,7 +159094,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -157249,9 +159133,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -157476,9 +159361,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -157615,7 +159505,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -157839,12 +159729,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -157861,15 +159751,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -158040,25 +159932,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -158067,9 +159962,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -158114,9 +160010,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -158155,8 +160051,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -158229,8 +160125,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -158256,7 +160152,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -158272,7 +160169,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -158295,7 +160192,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -158334,9 +160231,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -158561,9 +160459,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -158700,7 +160603,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -158924,12 +160827,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -158946,15 +160849,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -159125,25 +161030,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -159152,9 +161060,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -159199,9 +161108,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -159240,8 +161149,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -159314,8 +161223,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -159341,7 +161250,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -159357,7 +161267,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -159380,7 +161290,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -159419,9 +161329,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -159646,9 +161557,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -159785,7 +161701,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -160009,12 +161925,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -160031,15 +161947,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -160210,25 +162128,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -160237,9 +162158,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -160284,9 +162206,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -160325,8 +162247,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -160399,8 +162321,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -160426,7 +162348,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -160442,7 +162365,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -160465,7 +162388,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -160504,9 +162427,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -160731,9 +162655,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -160870,7 +162799,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -161094,12 +163023,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -161116,15 +163045,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -161295,25 +163226,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -161322,9 +163256,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -161369,9 +163304,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -161410,8 +163345,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -161484,8 +163419,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -161511,7 +163446,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -161527,7 +163463,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -161550,7 +163486,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -161589,9 +163525,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -161816,9 +163753,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -161955,7 +163897,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -162179,12 +164121,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -162201,15 +164143,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -162380,25 +164324,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -162407,9 +164354,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -162454,9 +164402,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -162495,8 +164443,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -162569,8 +164517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -162596,7 +164544,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -162612,7 +164561,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -162635,7 +164584,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -162674,9 +164623,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -162901,9 +164851,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -163040,7 +164995,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -163264,12 +165219,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -163286,15 +165241,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -163465,25 +165422,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -163492,9 +165452,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -163539,9 +165500,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -163580,8 +165541,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -163654,8 +165615,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -163681,7 +165642,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -163697,7 +165659,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -163720,7 +165682,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -163759,9 +165721,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -163986,9 +165949,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -164125,7 +166093,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -164349,12 +166317,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -164371,15 +166339,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -164550,25 +166520,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -164577,9 +166550,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -164624,9 +166598,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -164665,8 +166639,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -164739,8 +166713,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -164766,7 +166740,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -164782,7 +166757,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -164805,7 +166780,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -164844,9 +166819,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -165071,9 +167047,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -165210,7 +167191,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -165434,12 +167415,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -165456,15 +167437,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -165635,25 +167618,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -165662,9 +167648,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -165709,9 +167696,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -165750,8 +167737,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -165824,8 +167811,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -165851,7 +167838,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -165867,7 +167855,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -165890,7 +167878,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -165929,9 +167917,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -166156,9 +168145,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -166295,7 +168289,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -166519,12 +168513,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -166541,15 +168535,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -166720,25 +168716,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -166747,9 +168746,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -166794,9 +168794,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -166835,8 +168835,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -166909,8 +168909,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -166936,7 +168936,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -166952,7 +168953,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -166975,7 +168976,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -167014,9 +169015,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -167241,9 +169243,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -167380,7 +169387,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -167604,12 +169611,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -167626,15 +169633,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -167805,25 +169814,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -167832,9 +169844,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -167879,9 +169892,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -167920,8 +169933,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -167994,8 +170007,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -168021,7 +170034,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -168037,7 +170051,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -168060,7 +170074,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -168099,9 +170113,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -168326,9 +170341,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -168465,7 +170485,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -168689,12 +170709,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -168711,15 +170731,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -168890,25 +170912,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -168917,9 +170942,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -168964,9 +170990,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -169005,8 +171031,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -169079,8 +171105,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -169106,7 +171132,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -169122,7 +171149,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -169145,7 +171172,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -169184,9 +171211,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -169411,9 +171439,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -169550,7 +171583,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -169774,12 +171807,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -169796,15 +171829,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -169975,25 +172010,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -170002,9 +172040,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -170049,9 +172088,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -170090,8 +172129,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -170164,8 +172203,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -170191,7 +172230,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -170207,7 +172247,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -170230,7 +172270,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -170269,9 +172309,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -170496,9 +172537,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -170635,7 +172681,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -170859,12 +172905,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -170881,15 +172927,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -171060,25 +173108,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -171087,9 +173138,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -171134,9 +173186,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -171175,8 +173227,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -171249,8 +173301,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -171276,7 +173328,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -171292,7 +173345,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -171315,7 +173368,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -171354,9 +173407,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -171581,9 +173635,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -171720,7 +173779,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -171944,12 +174003,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -171966,15 +174025,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -172145,25 +174206,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -172172,9 +174236,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -172219,9 +174284,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -172260,8 +174325,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -172334,8 +174399,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -172361,7 +174426,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -172377,7 +174443,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -172400,7 +174466,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -172439,9 +174505,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -172666,9 +174733,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -172805,7 +174877,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -173029,12 +175101,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -173051,15 +175123,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -173230,25 +175304,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -173257,9 +175334,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -173304,9 +175382,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -173345,8 +175423,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -173419,8 +175497,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -173446,7 +175524,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -173462,7 +175541,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -173485,7 +175564,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -173524,9 +175603,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -173751,9 +175831,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -173890,7 +175975,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -174114,12 +176199,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -174136,15 +176221,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -174315,25 +176402,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -174342,9 +176432,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -174389,9 +176480,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -174430,8 +176521,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -174504,8 +176595,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -174531,7 +176622,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -174547,7 +176639,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -174570,7 +176662,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -174609,9 +176701,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -174836,9 +176929,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -174975,7 +177073,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -175199,12 +177297,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -175221,15 +177319,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -175400,25 +177500,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -175427,9 +177530,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -175474,9 +177578,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -175515,8 +177619,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -175589,8 +177693,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -175616,7 +177720,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -175632,7 +177737,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -175655,7 +177760,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -175694,9 +177799,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -175921,9 +178027,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -176060,7 +178171,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -176284,12 +178395,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -176306,15 +178417,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -176485,25 +178598,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -176512,9 +178628,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -176559,9 +178676,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -176600,8 +178717,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -176674,8 +178791,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -176701,7 +178818,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -176717,7 +178835,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -176740,7 +178858,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -176779,9 +178897,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -177006,9 +179125,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -177145,7 +179269,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -177369,12 +179493,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -177391,15 +179515,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -177570,25 +179696,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -177597,9 +179726,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -177644,9 +179774,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -177685,8 +179815,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -177759,8 +179889,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -177786,7 +179916,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -177802,7 +179933,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -177825,7 +179956,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -177864,9 +179995,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -178091,9 +180223,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -178230,7 +180367,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -178454,12 +180591,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -178476,15 +180613,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -178655,25 +180794,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -178682,9 +180824,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -178729,9 +180872,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -178770,8 +180913,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -178844,8 +180987,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -178871,7 +181014,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -178887,7 +181031,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -178910,7 +181054,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -178949,9 +181093,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -179176,9 +181321,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -179315,7 +181465,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -179539,12 +181689,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -179561,15 +181711,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -179740,25 +181892,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -179767,9 +181922,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -179814,9 +181970,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -179855,8 +182011,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -179929,8 +182085,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -179956,7 +182112,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -179972,7 +182129,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -179995,7 +182152,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -180034,9 +182191,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -180261,9 +182419,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -180400,7 +182563,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -180624,12 +182787,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -180646,15 +182809,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -180825,25 +182990,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -180852,9 +183020,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -180899,9 +183068,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -180940,8 +183109,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -181014,8 +183183,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -181041,7 +183210,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -181057,7 +183227,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -181080,7 +183250,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -181119,9 +183289,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -181346,9 +183517,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -181485,7 +183661,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -181709,12 +183885,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -181731,15 +183907,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -181910,25 +184088,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -181937,9 +184118,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -181984,9 +184166,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -182025,8 +184207,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -182099,8 +184281,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -182126,7 +184308,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -182142,7 +184325,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -182165,7 +184348,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -182204,9 +184387,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -182431,9 +184615,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -182570,7 +184759,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -182794,12 +184983,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -182816,15 +185005,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -182995,25 +185186,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -183022,9 +185216,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -183069,9 +185264,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -183110,8 +185305,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -183184,8 +185379,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -183211,7 +185406,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -183227,7 +185423,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -183250,7 +185446,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -183289,9 +185485,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -183516,9 +185713,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -183655,7 +185857,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -183879,12 +186081,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -183901,15 +186103,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -184080,25 +186284,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -184107,9 +186314,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -184154,9 +186362,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -184195,8 +186403,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -184269,8 +186477,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -184296,7 +186504,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -184312,7 +186521,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -184335,7 +186544,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -184374,9 +186583,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -184601,9 +186811,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -184740,7 +186955,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -184964,12 +187179,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -184986,15 +187201,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -185165,25 +187382,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -185192,9 +187412,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -185239,9 +187460,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -185280,8 +187501,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -185354,8 +187575,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -185381,7 +187602,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -185397,7 +187619,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -185420,7 +187642,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -185459,9 +187681,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -185686,9 +187909,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -185825,7 +188053,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -186049,12 +188277,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -186071,15 +188299,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -186250,25 +188480,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -186277,9 +188510,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -186324,9 +188558,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -186365,8 +188599,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -186439,8 +188673,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -186466,7 +188700,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -186482,7 +188717,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -186505,7 +188740,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -186544,9 +188779,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -186771,9 +189007,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -186910,7 +189151,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -187134,12 +189375,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -187156,15 +189397,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -187335,25 +189578,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -187362,9 +189608,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -187409,9 +189656,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -187450,8 +189697,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -187524,8 +189771,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -187551,7 +189798,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -187567,7 +189815,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -187590,7 +189838,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -187629,9 +189877,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -187856,9 +190105,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -187995,7 +190249,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -188219,12 +190473,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -188241,15 +190495,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -188420,25 +190676,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -188447,9 +190706,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -188494,9 +190754,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -188535,8 +190795,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -188609,8 +190869,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -188636,7 +190896,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -188652,7 +190913,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -188675,7 +190936,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -188714,9 +190975,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -188941,9 +191203,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -189080,7 +191347,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -189304,12 +191571,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -189326,15 +191593,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -189505,25 +191774,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -189532,9 +191804,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -189579,9 +191852,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -189620,8 +191893,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -189694,8 +191967,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -189721,7 +191994,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -189737,7 +192011,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -189760,7 +192034,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -189799,9 +192073,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -190026,9 +192301,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -190165,7 +192445,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -190389,12 +192669,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -190411,15 +192691,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -190590,25 +192872,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -190617,9 +192902,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -190664,9 +192950,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -190705,8 +192991,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -190779,8 +193065,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -190806,7 +193092,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -190822,7 +193109,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -190845,7 +193132,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -190884,9 +193171,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -191111,9 +193399,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -191250,7 +193543,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -191474,12 +193767,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -191496,15 +193789,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -191675,25 +193970,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -191702,9 +194000,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -191749,9 +194048,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -191790,8 +194089,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -191864,8 +194163,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -191891,7 +194190,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -191907,7 +194207,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -191930,7 +194230,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -191969,9 +194269,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -192196,9 +194497,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -192335,7 +194641,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -192559,12 +194865,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -192581,15 +194887,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -192760,25 +195068,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -192787,9 +195098,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -192834,9 +195146,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -192875,8 +195187,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -192949,8 +195261,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -192976,7 +195288,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -192992,7 +195305,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -193015,7 +195328,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -193054,9 +195367,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -193281,9 +195595,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -193420,7 +195739,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -193644,12 +195963,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -193666,15 +195985,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -193845,25 +196166,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -193872,9 +196196,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -193919,9 +196244,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -193960,8 +196285,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -194034,8 +196359,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -194061,7 +196386,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -194077,7 +196403,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -194100,7 +196426,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -194139,9 +196465,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -194366,9 +196693,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -194505,7 +196837,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -194729,12 +197061,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -194751,15 +197083,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -194930,25 +197264,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -194957,9 +197294,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -195004,9 +197342,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -195045,8 +197383,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -195119,8 +197457,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -195146,7 +197484,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -195162,7 +197501,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -195185,7 +197524,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -195224,9 +197563,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -195451,9 +197791,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -195590,7 +197935,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -195814,12 +198159,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -195836,15 +198181,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -196015,25 +198362,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -196042,9 +198392,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -196089,9 +198440,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -196130,8 +198481,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -196204,8 +198555,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -196231,7 +198582,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -196247,7 +198599,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -196270,7 +198622,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -196309,9 +198661,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -196536,9 +198889,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -196675,7 +199033,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -196899,12 +199257,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -196921,15 +199279,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -197100,25 +199460,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -197127,9 +199490,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -197174,9 +199538,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -197215,8 +199579,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -197289,8 +199653,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -197316,7 +199680,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -197332,7 +199697,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -197355,7 +199720,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -197394,9 +199759,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -197621,9 +199987,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -197760,7 +200131,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -197984,12 +200355,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -198006,15 +200377,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -198185,25 +200558,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -198212,9 +200588,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -198259,9 +200636,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -198300,8 +200677,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -198374,8 +200751,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -198401,7 +200778,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -198417,7 +200795,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -198440,7 +200818,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -198479,9 +200857,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -198706,9 +201085,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -198845,7 +201229,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -199069,12 +201453,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -199091,15 +201475,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -199270,25 +201656,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -199297,9 +201686,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -199344,9 +201734,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -199385,8 +201775,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -199459,8 +201849,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -199486,7 +201876,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -199502,7 +201893,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -199525,7 +201916,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -199564,9 +201955,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -199791,9 +202183,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -199930,7 +202327,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -200154,12 +202551,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -200176,15 +202573,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -200355,25 +202754,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -200382,9 +202784,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -200429,9 +202832,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -200470,8 +202873,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -200544,8 +202947,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -200571,7 +202974,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -200587,7 +202991,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -200610,7 +203014,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -200649,9 +203053,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -200876,9 +203281,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -201015,7 +203425,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -201239,12 +203649,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -201261,15 +203671,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -201440,25 +203852,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -201467,9 +203882,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -201514,9 +203930,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -201555,8 +203971,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -201629,8 +204045,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -201656,7 +204072,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -201672,7 +204089,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -201695,7 +204112,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -201734,9 +204151,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -201961,9 +204379,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -202100,7 +204523,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -202324,12 +204747,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -202346,15 +204769,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -202525,25 +204950,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -202552,9 +204980,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -202599,9 +205028,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -202640,8 +205069,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -202714,8 +205143,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -202741,7 +205170,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -202757,7 +205187,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -202780,7 +205210,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -202819,9 +205249,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -203046,9 +205477,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -203185,7 +205621,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -203409,12 +205845,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -203431,15 +205867,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -203610,25 +206048,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -203637,9 +206078,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -203684,9 +206126,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -203725,8 +206167,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -203799,8 +206241,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -203826,7 +206268,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -203842,7 +206285,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -203865,7 +206308,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -203904,9 +206347,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -204131,9 +206575,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -204270,7 +206719,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -204494,12 +206943,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -204516,15 +206965,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -204695,25 +207146,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -204722,9 +207176,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -204769,9 +207224,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -204810,8 +207265,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -204884,8 +207339,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -204911,7 +207366,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -204927,7 +207383,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -204950,7 +207406,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -204989,9 +207445,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -205216,9 +207673,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -205355,7 +207817,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -205579,12 +208041,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -205601,15 +208063,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -205780,25 +208244,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -205807,9 +208274,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -205854,9 +208322,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -205895,8 +208363,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -205969,8 +208437,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -205996,7 +208464,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -206012,7 +208481,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -206035,7 +208504,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -206074,9 +208543,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -206301,9 +208771,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -206440,7 +208915,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -206664,12 +209139,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -206686,15 +209161,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -206865,25 +209342,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -206892,9 +209372,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -206939,9 +209420,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -206980,8 +209461,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -207054,8 +209535,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -207081,7 +209562,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -207097,7 +209579,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -207120,7 +209602,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -207159,9 +209641,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -207386,9 +209869,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -207525,7 +210013,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -207749,12 +210237,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -207771,15 +210259,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -207950,25 +210440,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -207977,9 +210470,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -208024,9 +210518,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -208065,8 +210559,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -208139,8 +210633,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -208166,7 +210660,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -208182,7 +210677,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -208205,7 +210700,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -208244,9 +210739,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -208471,9 +210967,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -208610,7 +211111,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -208834,12 +211335,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -208856,15 +211357,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -209035,25 +211538,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -209062,9 +211568,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -209109,9 +211616,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -209150,8 +211657,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -209224,8 +211731,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -209251,7 +211758,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -209267,7 +211775,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -209290,7 +211798,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -209329,9 +211837,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -209556,9 +212065,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -209695,7 +212209,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -209919,12 +212433,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -209941,15 +212455,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -210120,25 +212636,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -210147,9 +212666,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -210194,9 +212714,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -210235,8 +212755,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -210309,8 +212829,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -210336,7 +212856,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -210352,7 +212873,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -210375,7 +212896,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -210414,9 +212935,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -210641,9 +213163,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -210780,7 +213307,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -211004,12 +213531,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -211026,15 +213553,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -211205,25 +213734,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -211232,9 +213764,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -211279,9 +213812,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -211320,8 +213853,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -211394,8 +213927,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -211421,7 +213954,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -211437,7 +213971,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -211460,7 +213994,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -211499,9 +214033,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -211726,9 +214261,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -211865,7 +214405,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -212089,12 +214629,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -212111,15 +214651,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -212290,25 +214832,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -212317,9 +214862,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -212364,9 +214910,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -212405,8 +214951,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -212479,8 +215025,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -212506,7 +215052,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -212522,7 +215069,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -212545,7 +215092,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -212584,9 +215131,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -212811,9 +215359,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -212950,7 +215503,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -213174,12 +215727,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -213196,15 +215749,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -213375,25 +215930,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -213402,9 +215960,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -213449,9 +216008,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -213490,8 +216049,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -213564,8 +216123,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -213591,7 +216150,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -213607,7 +216167,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -213630,7 +216190,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -213669,9 +216229,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -213896,9 +216457,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -214035,7 +216601,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -214259,12 +216825,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -214281,15 +216847,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -214460,25 +217028,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -214487,9 +217058,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -214534,9 +217106,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -214575,8 +217147,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -214649,8 +217221,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -214676,7 +217248,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -214692,7 +217265,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -214715,7 +217288,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -214754,9 +217327,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -214981,9 +217555,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -215120,7 +217699,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -215344,12 +217923,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -215366,15 +217945,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -215545,25 +218126,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -215572,9 +218156,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -215619,9 +218204,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -215660,8 +218245,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -215734,8 +218319,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -215761,7 +218346,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -215777,7 +218363,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -215800,7 +218386,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -215839,9 +218425,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -216066,9 +218653,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -216205,7 +218797,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -216429,12 +219021,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -216451,15 +219043,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -216630,25 +219224,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -216657,9 +219254,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -216704,9 +219302,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -216745,8 +219343,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -216819,8 +219417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -216846,7 +219444,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -216862,7 +219461,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -216885,7 +219484,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -216924,9 +219523,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -217151,9 +219751,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -217290,7 +219895,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -217514,12 +220119,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -217536,15 +220141,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -217715,25 +220322,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -217742,9 +220352,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -217789,9 +220400,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -217830,8 +220441,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -217904,8 +220515,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -217931,7 +220542,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -217947,7 +220559,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -217970,7 +220582,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -218009,9 +220621,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -218236,9 +220849,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -218375,7 +220993,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -218599,12 +221217,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -218621,15 +221239,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -218800,25 +221420,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -218827,9 +221450,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -218874,9 +221498,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -218915,8 +221539,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -218989,8 +221613,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -219016,7 +221640,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -219032,7 +221657,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -219055,7 +221680,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -219094,9 +221719,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -219321,9 +221947,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -219460,7 +222091,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -219684,12 +222315,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -219706,15 +222337,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -219885,25 +222518,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -219912,9 +222548,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -219959,9 +222596,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -220000,8 +222637,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -220074,8 +222711,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -220101,7 +222738,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -220117,7 +222755,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -220140,7 +222778,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -220179,9 +222817,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -220406,9 +223045,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -220545,7 +223189,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -220769,12 +223413,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -220791,15 +223435,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -220970,25 +223616,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -220997,9 +223646,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -221044,9 +223694,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -221085,8 +223735,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -221159,8 +223809,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -221186,7 +223836,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -221202,7 +223853,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -221225,7 +223876,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -221264,9 +223915,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -221491,9 +224143,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -221630,7 +224287,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -221854,12 +224511,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -221876,15 +224533,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -222055,25 +224714,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -222082,9 +224744,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -222129,9 +224792,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -222170,8 +224833,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -222244,8 +224907,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -222271,7 +224934,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -222287,7 +224951,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -222310,7 +224974,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -222349,9 +225013,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -222576,9 +225241,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -222715,7 +225385,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -222939,12 +225609,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -222961,15 +225631,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -223140,25 +225812,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -223167,9 +225842,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -223214,9 +225890,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -223255,8 +225931,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -223329,8 +226005,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -223356,7 +226032,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -223372,7 +226049,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -223395,7 +226072,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -223434,9 +226111,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -223661,9 +226339,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -223800,7 +226483,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -224024,12 +226707,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -224046,15 +226729,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -224225,25 +226910,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -224252,9 +226940,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -224299,9 +226988,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -224340,8 +227029,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -224414,8 +227103,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -224441,7 +227130,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -224457,7 +227147,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -224480,7 +227170,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -224519,9 +227209,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -224746,9 +227437,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -224885,7 +227581,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -225109,12 +227805,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -225131,15 +227827,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -225310,25 +228008,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -225337,9 +228038,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -225384,9 +228086,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -225425,8 +228127,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -225499,8 +228201,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -225526,7 +228228,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -225542,7 +228245,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -225565,7 +228268,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -225604,9 +228307,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -225831,9 +228535,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -225970,7 +228679,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -226194,12 +228903,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -226216,15 +228925,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -226395,25 +229106,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -226422,9 +229136,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -226469,9 +229184,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -226510,8 +229225,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -226584,8 +229299,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -226611,7 +229326,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -226627,7 +229343,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -226650,7 +229366,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -226689,9 +229405,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -226916,9 +229633,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -227055,7 +229777,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -227279,12 +230001,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -227301,15 +230023,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -227480,25 +230204,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -227507,9 +230234,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -227554,9 +230282,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -227595,8 +230323,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -227669,8 +230397,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -227696,7 +230424,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -227712,7 +230441,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -227735,7 +230464,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -227774,9 +230503,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -228001,9 +230731,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -228140,7 +230875,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -228364,12 +231099,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -228386,15 +231121,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -228565,25 +231302,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -228592,9 +231332,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -228639,9 +231380,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -228680,8 +231421,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -228754,8 +231495,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -228781,7 +231522,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -228797,7 +231539,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -228820,7 +231562,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -228859,9 +231601,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -229086,9 +231829,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -229225,7 +231973,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -229449,12 +232197,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -229471,15 +232219,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -229650,25 +232400,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -229677,9 +232430,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -229724,9 +232478,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -229765,8 +232519,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -229839,8 +232593,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -229866,7 +232620,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -229882,7 +232637,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -229905,7 +232660,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -229944,9 +232699,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -230171,9 +232927,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -230310,7 +233071,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -230534,12 +233295,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -230556,15 +233317,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -230735,25 +233498,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -230762,9 +233528,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -230809,9 +233576,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -230850,8 +233617,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -230924,8 +233691,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -230951,7 +233718,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -230967,7 +233735,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -230990,7 +233758,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -231029,9 +233797,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -231256,9 +234025,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -231395,7 +234169,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -231619,12 +234393,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -231641,15 +234415,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -231820,25 +234596,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -231847,9 +234626,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -231894,9 +234674,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -231935,8 +234715,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -232009,8 +234789,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -232036,7 +234816,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -232052,7 +234833,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -232075,7 +234856,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -232114,9 +234895,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -232341,9 +235123,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -232480,7 +235267,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -232704,12 +235491,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -232726,15 +235513,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -232905,25 +235694,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -232932,9 +235724,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -232979,9 +235772,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -233020,8 +235813,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -233094,8 +235887,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -233121,7 +235914,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -233137,7 +235931,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -233160,7 +235954,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -233199,9 +235993,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -233426,9 +236221,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -233565,7 +236365,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -233789,12 +236589,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -233811,15 +236611,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -233990,25 +236792,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -234017,9 +236822,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -234064,9 +236870,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -234105,8 +236911,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -234179,8 +236985,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -234206,7 +237012,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -234222,7 +237029,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -234245,7 +237052,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -234284,9 +237091,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -234511,9 +237319,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -234650,7 +237463,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -234874,12 +237687,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -234896,15 +237709,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -235075,25 +237890,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -235102,9 +237920,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -235149,9 +237968,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -235190,8 +238009,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -235264,8 +238083,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -235291,7 +238110,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -235307,7 +238127,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -235330,7 +238150,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -235369,9 +238189,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -235596,9 +238417,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -235735,7 +238561,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -235959,12 +238785,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -235981,15 +238807,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -236160,25 +238988,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -236187,9 +239018,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -236234,9 +239066,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -236275,8 +239107,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -236349,8 +239181,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -236376,7 +239208,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -236392,7 +239225,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -236415,7 +239248,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -236454,9 +239287,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -236681,9 +239515,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -236820,7 +239659,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -237044,12 +239883,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -237066,15 +239905,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -237245,25 +240086,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -237272,9 +240116,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -237319,9 +240164,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -237360,8 +240205,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -237434,8 +240279,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -237461,7 +240306,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -237477,7 +240323,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -237500,7 +240346,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -237539,9 +240385,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -237766,9 +240613,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -237905,7 +240757,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -238129,12 +240981,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -238151,15 +241003,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -238330,25 +241184,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -238357,9 +241214,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -238404,9 +241262,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -238445,8 +241303,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -238519,8 +241377,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -238546,7 +241404,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -238562,7 +241421,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -238585,7 +241444,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -238624,9 +241483,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -238851,9 +241711,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -238990,7 +241855,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -239214,12 +242079,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -239236,15 +242101,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -239415,25 +242282,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -239442,9 +242312,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -239489,9 +242360,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -239530,8 +242401,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -239604,8 +242475,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -239631,7 +242502,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -239647,7 +242519,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -239670,7 +242542,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -239709,9 +242581,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -239936,9 +242809,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -240075,7 +242953,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -240299,12 +243177,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -240321,15 +243199,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -240500,25 +243380,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -240527,9 +243410,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -240574,9 +243458,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -240615,8 +243499,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -240689,8 +243573,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -240716,7 +243600,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -240732,7 +243617,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -240755,7 +243640,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -240794,9 +243679,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -241021,9 +243907,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -241160,7 +244051,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -241384,12 +244275,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -241406,15 +244297,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -241585,25 +244478,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -241612,9 +244508,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -241659,9 +244556,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -241700,8 +244597,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -241774,8 +244671,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -241801,7 +244698,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -241817,7 +244715,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -241840,7 +244738,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -241879,9 +244777,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -242106,9 +245005,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -242245,7 +245149,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -242469,12 +245373,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -242491,15 +245395,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -242670,25 +245576,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -242697,9 +245606,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -242744,9 +245654,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -242785,8 +245695,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -242859,8 +245769,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -242886,7 +245796,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -242902,7 +245813,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -242925,7 +245836,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -242964,9 +245875,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -243191,9 +246103,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -243330,7 +246247,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -243554,12 +246471,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -243576,15 +246493,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -243755,25 +246674,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -243782,9 +246704,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -243829,9 +246752,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -243870,8 +246793,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -243944,8 +246867,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -243971,7 +246894,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -243987,7 +246911,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -244010,7 +246934,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -244049,9 +246973,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -244276,9 +247201,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -244415,7 +247345,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -244639,12 +247569,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -244661,15 +247591,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -244840,25 +247772,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -244867,9 +247802,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -244914,9 +247850,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -244955,8 +247891,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -245029,8 +247965,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -245056,7 +247992,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -245072,7 +248009,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -245095,7 +248032,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -245134,9 +248071,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -245361,9 +248299,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -245500,7 +248443,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -245724,12 +248667,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -245746,15 +248689,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -245925,25 +248870,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -245952,9 +248900,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -245999,9 +248948,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -246040,8 +248989,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -246114,8 +249063,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -246141,7 +249090,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -246157,7 +249107,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -246180,7 +249130,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -246219,9 +249169,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -246446,9 +249397,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -246585,7 +249541,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -246809,12 +249765,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -246831,15 +249787,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -247010,25 +249968,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -247037,9 +249998,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -247084,9 +250046,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -247125,8 +250087,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -247199,8 +250161,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -247226,7 +250188,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -247242,7 +250205,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -247265,7 +250228,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -247304,9 +250267,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -247531,9 +250495,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -247670,7 +250639,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -247894,12 +250863,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -247916,15 +250885,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -248095,25 +251066,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -248122,9 +251096,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -248169,9 +251144,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -248210,8 +251185,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -248284,8 +251259,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -248311,7 +251286,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -248327,7 +251303,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -248350,7 +251326,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -248389,9 +251365,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -248616,9 +251593,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -248755,7 +251737,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -248979,12 +251961,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -249001,15 +251983,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -249180,25 +252164,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -249207,9 +252194,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -249254,9 +252242,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -249295,8 +252283,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -249369,8 +252357,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -249396,7 +252384,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -249412,7 +252401,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -249435,7 +252424,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -249474,9 +252463,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -249701,9 +252691,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -249840,7 +252835,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -250064,12 +253059,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -250086,15 +253081,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -250265,25 +253262,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -250292,9 +253292,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -250339,9 +253340,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -250380,8 +253381,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -250454,8 +253455,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -250481,7 +253482,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -250497,7 +253499,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -250520,7 +253522,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -250559,9 +253561,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -250786,9 +253789,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -250925,7 +253933,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -251149,12 +254157,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -251171,15 +254179,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -251350,25 +254360,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -251377,9 +254390,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -251424,9 +254438,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -251465,8 +254479,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -251539,8 +254553,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -251566,7 +254580,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -251582,7 +254597,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -251605,7 +254620,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -251644,9 +254659,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -251871,9 +254887,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -252010,7 +255031,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -252234,12 +255255,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -252256,15 +255277,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -252435,25 +255458,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -252462,9 +255488,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -252509,9 +255536,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -252550,8 +255577,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -252624,8 +255651,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -252651,7 +255678,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -252667,7 +255695,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -252690,7 +255718,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -252729,9 +255757,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -252956,9 +255985,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -253095,7 +256129,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -253319,12 +256353,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -253341,15 +256375,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -253520,25 +256556,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -253547,9 +256586,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -253594,9 +256634,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -253635,8 +256675,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -253709,8 +256749,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -253736,7 +256776,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -253752,7 +256793,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -253775,7 +256816,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -253814,9 +256855,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -254041,9 +257083,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -254180,7 +257227,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -254404,12 +257451,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -254426,15 +257473,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -254605,25 +257654,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -254632,9 +257684,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -254679,9 +257732,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -254720,8 +257773,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -254794,8 +257847,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -254821,7 +257874,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -254837,7 +257891,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -254860,7 +257914,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -254899,9 +257953,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -255126,9 +258181,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -255265,7 +258325,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -255489,12 +258549,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -255511,15 +258571,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -255690,25 +258752,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -255717,9 +258782,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -255764,9 +258830,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -255805,8 +258871,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -255879,8 +258945,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -255906,7 +258972,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -255922,7 +258989,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -255945,7 +259012,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -255984,9 +259051,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -256211,9 +259279,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -256350,7 +259423,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -256574,12 +259647,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -256596,15 +259669,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -256775,25 +259850,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -256802,9 +259880,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -256849,9 +259928,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -256890,8 +259969,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -256964,8 +260043,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -256991,7 +260070,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -257007,7 +260087,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -257030,7 +260110,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -257069,9 +260149,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -257296,9 +260377,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -257435,7 +260521,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -257659,12 +260745,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -257681,15 +260767,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -257860,25 +260948,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -257887,9 +260978,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -257934,9 +261026,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -257975,8 +261067,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -258049,8 +261141,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -258076,7 +261168,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -258092,7 +261185,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -258115,7 +261208,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -258154,9 +261247,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -258381,9 +261475,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -258520,7 +261619,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -258744,12 +261843,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -258766,15 +261865,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -258945,25 +262046,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -258972,9 +262076,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -259019,9 +262124,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -259060,8 +262165,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -259134,8 +262239,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -259161,7 +262266,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -259177,7 +262283,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -259200,7 +262306,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -259239,9 +262345,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -259466,9 +262573,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -259605,7 +262717,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -259829,12 +262941,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -259851,15 +262963,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -260030,25 +263144,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -260057,9 +263174,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -260104,9 +263222,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -260145,8 +263263,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -260219,8 +263337,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -260246,7 +263364,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -260262,7 +263381,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -260285,7 +263404,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -260324,9 +263443,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -260551,9 +263671,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -260690,7 +263815,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -260914,12 +264039,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -260936,15 +264061,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -261115,25 +264242,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -261142,9 +264272,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -261189,9 +264320,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -261230,8 +264361,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -261304,8 +264435,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -261331,7 +264462,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -261347,7 +264479,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -261370,7 +264502,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -261409,9 +264541,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -261636,9 +264769,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -261775,7 +264913,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -261999,12 +265137,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -262021,15 +265159,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -262200,25 +265340,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -262227,9 +265370,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -262274,9 +265418,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -262315,8 +265459,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -262389,8 +265533,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -262416,7 +265560,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -262432,7 +265577,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -262455,7 +265600,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -262494,9 +265639,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -262721,9 +265867,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -262860,7 +266011,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -263084,12 +266235,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -263106,15 +266257,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -263285,25 +266438,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -263312,9 +266468,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -263359,9 +266516,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -263400,8 +266557,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -263474,8 +266631,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -263501,7 +266658,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -263517,7 +266675,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -263540,7 +266698,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -263579,9 +266737,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -263806,9 +266965,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -263945,7 +267109,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -264169,12 +267333,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -264191,15 +267355,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -264370,25 +267536,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -264397,9 +267566,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -264444,9 +267614,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -264485,8 +267655,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -264559,8 +267729,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -264586,7 +267756,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -264602,7 +267773,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -264625,7 +267796,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -264664,9 +267835,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -264891,9 +268063,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -265030,7 +268207,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -265254,12 +268431,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -265276,15 +268453,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -265455,25 +268634,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -265482,9 +268664,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -265529,9 +268712,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -265570,8 +268753,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -265644,8 +268827,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -265671,7 +268854,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -265687,7 +268871,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -265710,7 +268894,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -265749,9 +268933,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -265976,9 +269161,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -266115,7 +269305,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -266339,12 +269529,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -266361,15 +269551,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -266540,25 +269732,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -266567,9 +269762,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -266614,9 +269810,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -266655,8 +269851,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -266729,8 +269925,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -266756,7 +269952,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -266772,7 +269969,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -266795,7 +269992,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -266834,9 +270031,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -267061,9 +270259,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -267200,7 +270403,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -267424,12 +270627,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -267446,15 +270649,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -267625,25 +270830,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -267652,9 +270860,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -267699,9 +270908,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -267740,8 +270949,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -267814,8 +271023,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -267841,7 +271050,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -267857,7 +271067,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -267880,7 +271090,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -267919,9 +271129,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -268146,9 +271357,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -268285,7 +271501,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -268509,12 +271725,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -268531,15 +271747,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -268710,25 +271928,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -268737,9 +271958,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -268784,9 +272006,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -268825,8 +272047,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -268899,8 +272121,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -268926,7 +272148,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -268942,7 +272165,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -268965,7 +272188,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -269004,9 +272227,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -269231,9 +272455,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -269370,7 +272599,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -269594,12 +272823,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -269616,15 +272845,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -269795,25 +273026,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -269822,9 +273056,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -269869,9 +273104,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -269910,8 +273145,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -269984,8 +273219,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -270011,7 +273246,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -270027,7 +273263,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -270050,7 +273286,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -270089,9 +273325,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -270316,9 +273553,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -270455,7 +273697,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -270679,12 +273921,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -270701,15 +273943,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -270880,25 +274124,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -270907,9 +274154,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -270954,9 +274202,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -270995,8 +274243,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -271069,8 +274317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -271096,7 +274344,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -271112,7 +274361,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -271135,7 +274384,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -271174,9 +274423,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -271401,9 +274651,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -271540,7 +274795,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -271764,12 +275019,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -271786,15 +275041,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -271965,25 +275222,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -271992,9 +275252,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -272039,9 +275300,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -272080,8 +275341,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -272154,8 +275415,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -272181,7 +275442,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -272197,7 +275459,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -272220,7 +275482,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -272259,9 +275521,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -272486,9 +275749,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -272625,7 +275893,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -272849,12 +276117,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -272871,15 +276139,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -273050,25 +276320,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -273077,9 +276350,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -273124,9 +276398,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -273165,8 +276439,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -273239,8 +276513,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -273266,7 +276540,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -273282,7 +276557,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -273305,7 +276580,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -273344,9 +276619,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -273571,9 +276847,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -273710,7 +276991,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -273934,12 +277215,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -273956,15 +277237,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -274135,25 +277418,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -274162,9 +277448,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -274209,9 +277496,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -274250,8 +277537,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -274324,8 +277611,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -274351,7 +277638,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -274367,7 +277655,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -274390,7 +277678,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -274429,9 +277717,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -274656,9 +277945,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -274795,7 +278089,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -275019,12 +278313,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -275041,15 +278335,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -275220,25 +278516,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -275247,9 +278546,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -275294,9 +278594,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -275335,8 +278635,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -275409,8 +278709,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -275436,7 +278736,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -275452,7 +278753,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -275475,7 +278776,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -275514,9 +278815,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -275741,9 +279043,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -275880,7 +279187,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -276104,12 +279411,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -276126,15 +279433,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -276305,25 +279614,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -276332,9 +279644,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -276379,9 +279692,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -276420,8 +279733,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -276494,8 +279807,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -276521,7 +279834,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -276537,7 +279851,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -276560,7 +279874,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -276599,9 +279913,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -276826,9 +280141,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -276965,7 +280285,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -277189,12 +280509,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -277211,15 +280531,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -277390,25 +280712,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -277417,9 +280742,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -277464,9 +280790,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -277505,8 +280831,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -277579,8 +280905,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -277606,7 +280932,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -277622,7 +280949,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -277645,7 +280972,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -277684,9 +281011,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -277911,9 +281239,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -278050,7 +281383,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -278274,12 +281607,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -278296,15 +281629,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -278475,25 +281810,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -278502,9 +281840,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -278549,9 +281888,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -278590,8 +281929,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -278664,8 +282003,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -278691,7 +282030,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -278707,7 +282047,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -278730,7 +282070,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -278769,9 +282109,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -278996,9 +282337,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -279135,7 +282481,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -279359,12 +282705,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -279381,15 +282727,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -279560,25 +282908,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -279587,9 +282938,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -279634,9 +282986,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -279675,8 +283027,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -279749,8 +283101,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -279776,7 +283128,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -279792,7 +283145,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -279815,7 +283168,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -279854,9 +283207,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -280081,9 +283435,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -280220,7 +283579,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -280444,12 +283803,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -280466,15 +283825,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -280645,25 +284006,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -280672,9 +284036,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -280719,9 +284084,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -280760,8 +284125,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -280834,8 +284199,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -280861,7 +284226,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -280877,7 +284243,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -280900,7 +284266,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -280939,9 +284305,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -281166,9 +284533,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -281305,7 +284677,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -281529,12 +284901,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -281551,15 +284923,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -281730,25 +285104,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -281757,9 +285134,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -281804,9 +285182,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -281845,8 +285223,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -281919,8 +285297,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -281946,7 +285324,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -281962,7 +285341,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -281985,7 +285364,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -282024,9 +285403,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -282251,9 +285631,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -282390,7 +285775,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -282614,12 +285999,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -282636,15 +286021,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -282815,25 +286202,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -282842,9 +286232,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -282889,9 +286280,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -282930,8 +286321,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -283004,8 +286395,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -283031,7 +286422,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -283047,7 +286439,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -283070,7 +286462,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -283109,9 +286501,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -283336,9 +286729,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -283475,7 +286873,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -283699,12 +287097,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -283721,15 +287119,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -283900,25 +287300,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -283927,9 +287330,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -283974,9 +287378,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -284015,8 +287419,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -284089,8 +287493,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -284116,7 +287520,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -284132,7 +287537,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -284155,7 +287560,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -284194,9 +287599,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -284421,9 +287827,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -284560,7 +287971,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -284784,12 +288195,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -284806,15 +288217,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -284985,25 +288398,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -285012,9 +288428,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -285059,9 +288476,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -285100,8 +288517,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -285174,8 +288591,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -285201,7 +288618,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -285217,7 +288635,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -285240,7 +288658,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -285279,9 +288697,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -285506,9 +288925,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -285645,7 +289069,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -285869,12 +289293,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -285891,15 +289315,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -286070,25 +289496,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -286097,9 +289526,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -286144,9 +289574,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -286185,8 +289615,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -286259,8 +289689,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -286286,7 +289716,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -286302,7 +289733,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -286325,7 +289756,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -286364,9 +289795,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -286591,9 +290023,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -286730,7 +290167,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -286954,12 +290391,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -286976,15 +290413,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -287155,25 +290594,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -287182,9 +290624,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -287229,9 +290672,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -287270,8 +290713,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -287344,8 +290787,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -287371,7 +290814,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -287387,7 +290831,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -287410,7 +290854,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -287449,9 +290893,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -287676,9 +291121,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -287815,7 +291265,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -288039,12 +291489,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -288061,15 +291511,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -288240,25 +291692,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -288267,9 +291722,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -288314,9 +291770,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -288355,8 +291811,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -288429,8 +291885,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -288456,7 +291912,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -288472,7 +291929,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -288495,7 +291952,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -288534,9 +291991,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -288761,9 +292219,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -288900,7 +292363,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -289124,12 +292587,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -289146,15 +292609,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -289325,25 +292790,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -289352,9 +292820,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -289399,9 +292868,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -289440,8 +292909,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -289514,8 +292983,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -289541,7 +293010,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -289557,7 +293027,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -289580,7 +293050,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -289619,9 +293089,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -289846,9 +293317,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -289985,7 +293461,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -290209,12 +293685,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -290231,15 +293707,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -290410,25 +293888,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -290437,9 +293918,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -290484,9 +293966,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -290525,8 +294007,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -290599,8 +294081,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -290626,7 +294108,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -290642,7 +294125,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -290665,7 +294148,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -290704,9 +294187,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -290931,9 +294415,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -291070,7 +294559,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -291294,12 +294783,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -291316,15 +294805,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -291495,25 +294986,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -291522,9 +295016,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -291569,9 +295064,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -291610,8 +295105,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -291684,8 +295179,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -291711,7 +295206,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -291727,7 +295223,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -291750,7 +295246,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -291789,9 +295285,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -292016,9 +295513,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -292155,7 +295657,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -292379,12 +295881,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -292401,15 +295903,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -292580,25 +296084,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -292607,9 +296114,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -292654,9 +296162,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -292695,8 +296203,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -292769,8 +296277,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -292796,7 +296304,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -292812,7 +296321,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -292835,7 +296344,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -292874,9 +296383,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -293101,9 +296611,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -293240,7 +296755,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -293464,12 +296979,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -293486,15 +297001,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -293665,25 +297182,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -293692,9 +297212,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -293739,9 +297260,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -293780,8 +297301,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -293854,8 +297375,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -293881,7 +297402,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -293897,7 +297419,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -293920,7 +297442,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -293959,9 +297481,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -294186,9 +297709,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -294325,7 +297853,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -294549,12 +298077,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -294571,15 +298099,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -294750,25 +298280,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -294777,9 +298310,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -294824,9 +298358,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -294865,8 +298399,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -294939,8 +298473,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -294966,7 +298500,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -294982,7 +298517,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -295005,7 +298540,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -295044,9 +298579,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -295271,9 +298807,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -295410,7 +298951,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -295634,12 +299175,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -295656,15 +299197,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -295835,25 +299378,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -295862,9 +299408,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -295909,9 +299456,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -295950,8 +299497,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -296024,8 +299571,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -296051,7 +299598,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -296067,7 +299615,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -296090,7 +299638,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -296129,9 +299677,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -296356,9 +299905,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -296495,7 +300049,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -296719,12 +300273,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -296741,15 +300295,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -296920,25 +300476,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -296947,9 +300506,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -296994,9 +300554,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -297035,8 +300595,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -297109,8 +300669,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -297136,7 +300696,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -297152,7 +300713,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -297175,7 +300736,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -297214,9 +300775,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -297441,9 +301003,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -297580,7 +301147,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -297804,12 +301371,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -297826,15 +301393,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -298005,25 +301574,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -298032,9 +301604,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -298079,9 +301652,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -298120,8 +301693,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -298194,8 +301767,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -298221,7 +301794,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -298237,7 +301811,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -298260,7 +301834,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -298299,9 +301873,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -298526,9 +302101,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -298665,7 +302245,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -298889,12 +302469,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -298911,15 +302491,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -299090,25 +302672,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -299117,9 +302702,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -299164,9 +302750,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -299205,8 +302791,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -299279,8 +302865,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -299306,7 +302892,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -299322,7 +302909,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -299345,7 +302932,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -299384,9 +302971,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -299611,9 +303199,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -299750,7 +303343,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -299974,12 +303567,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -299996,15 +303589,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -300175,25 +303770,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -300202,9 +303800,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -300249,9 +303848,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -300290,8 +303889,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -300364,8 +303963,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -300391,7 +303990,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -300407,7 +304007,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -300430,7 +304030,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -300469,9 +304069,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -300696,9 +304297,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -300835,7 +304441,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -301059,12 +304665,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -301081,15 +304687,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -301260,25 +304868,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -301287,9 +304898,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -301334,9 +304946,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -301375,8 +304987,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -301449,8 +305061,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -301476,7 +305088,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -301492,7 +305105,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -301515,7 +305128,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -301554,9 +305167,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -301781,9 +305395,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -301920,7 +305539,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -302144,12 +305763,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -302166,15 +305785,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -302345,25 +305966,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -302372,9 +305996,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -302419,9 +306044,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -302460,8 +306085,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -302534,8 +306159,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -302561,7 +306186,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -302577,7 +306203,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -302600,7 +306226,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -302639,9 +306265,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -302866,9 +306493,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -303005,7 +306637,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -303229,12 +306861,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -303251,15 +306883,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -303430,25 +307064,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -303457,9 +307094,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -303504,9 +307142,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -303545,8 +307183,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -303619,8 +307257,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -303646,7 +307284,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -303662,7 +307301,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -303685,7 +307324,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -303724,9 +307363,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -303951,9 +307591,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -304090,7 +307735,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -304314,12 +307959,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -304336,15 +307981,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -304515,25 +308162,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -304542,9 +308192,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -304589,9 +308240,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -304630,8 +308281,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -304704,8 +308355,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -304731,7 +308382,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -304747,7 +308399,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -304770,7 +308422,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -304809,9 +308461,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -305036,9 +308689,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -305175,7 +308833,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -305399,12 +309057,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -305421,15 +309079,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -305600,25 +309260,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -305627,9 +309290,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -305674,9 +309338,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -305715,8 +309379,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -305789,8 +309453,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -305816,7 +309480,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -305832,7 +309497,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -305855,7 +309520,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -305894,9 +309559,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -306121,9 +309787,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -306260,7 +309931,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -306484,12 +310155,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -306506,15 +310177,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -306685,25 +310358,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -306712,9 +310388,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -306759,9 +310436,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -306800,8 +310477,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -306874,8 +310551,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -306901,7 +310578,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -306917,7 +310595,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -306940,7 +310618,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -306979,9 +310657,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -307206,9 +310885,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -307345,7 +311029,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -307569,12 +311253,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -307591,15 +311275,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -307770,25 +311456,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -307797,9 +311486,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -307844,9 +311534,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -307885,8 +311575,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -307959,8 +311649,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -307986,7 +311676,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -308002,7 +311693,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -308025,7 +311716,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -308064,9 +311755,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -308291,9 +311983,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -308430,7 +312127,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -308654,12 +312351,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -308676,15 +312373,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -308855,25 +312554,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -308882,9 +312584,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -308929,9 +312632,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -308970,8 +312673,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -309044,8 +312747,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -309071,7 +312774,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -309087,7 +312791,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -309110,7 +312814,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -309149,9 +312853,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -309376,9 +313081,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -309515,7 +313225,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -309739,12 +313449,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -309761,15 +313471,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -309940,25 +313652,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -309967,9 +313682,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -310014,9 +313730,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -310055,8 +313771,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -310129,8 +313845,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -310156,7 +313872,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -310172,7 +313889,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -310195,7 +313912,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -310234,9 +313951,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -310461,9 +314179,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -310600,7 +314323,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -310824,12 +314547,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -310846,15 +314569,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -311025,25 +314750,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -311052,9 +314780,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -311099,9 +314828,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -311140,8 +314869,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -311214,8 +314943,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -311241,7 +314970,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -311257,7 +314987,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -311280,7 +315010,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -311319,9 +315049,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -311546,9 +315277,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -311685,7 +315421,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -311909,12 +315645,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -311931,15 +315667,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -312110,25 +315848,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -312137,9 +315878,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -312184,9 +315926,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -312225,8 +315967,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -312299,8 +316041,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -312326,7 +316068,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -312342,7 +316085,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -312365,7 +316108,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -312404,9 +316147,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -312631,9 +316375,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -312770,7 +316519,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -312994,12 +316743,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -313016,15 +316765,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -313195,25 +316946,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -313222,9 +316976,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -313269,9 +317024,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -313310,8 +317065,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -313384,8 +317139,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -313411,7 +317166,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -313427,7 +317183,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -313450,7 +317206,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -313489,9 +317245,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -313716,9 +317473,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -313855,7 +317617,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -314079,12 +317841,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -314101,15 +317863,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -314280,25 +318044,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -314307,9 +318074,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -314354,9 +318122,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -314395,8 +318163,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -314469,8 +318237,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -314496,7 +318264,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -314512,7 +318281,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -314535,7 +318304,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -314574,9 +318343,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -314801,9 +318571,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -314940,7 +318715,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -315164,12 +318939,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -315186,15 +318961,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -315365,25 +319142,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -315392,9 +319172,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -315439,9 +319220,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -315480,8 +319261,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -315554,8 +319335,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -315581,7 +319362,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -315597,7 +319379,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -315620,7 +319402,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -315659,9 +319441,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -315886,9 +319669,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -316025,7 +319813,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -316249,12 +320037,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -316271,15 +320059,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -316450,25 +320240,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -316477,9 +320270,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -316524,9 +320318,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -316565,8 +320359,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -316639,8 +320433,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -316666,7 +320460,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -316682,7 +320477,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -316705,7 +320500,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -316744,9 +320539,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -316971,9 +320767,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -317110,7 +320911,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -317334,12 +321135,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -317356,15 +321157,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -317535,25 +321338,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -317562,9 +321368,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -317609,9 +321416,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -317650,8 +321457,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -317724,8 +321531,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -317751,7 +321558,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -317767,7 +321575,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -317790,7 +321598,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -317829,9 +321637,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -318056,9 +321865,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -318195,7 +322009,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -318419,12 +322233,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -318441,15 +322255,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -318620,25 +322436,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -318647,9 +322466,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -318694,9 +322514,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -318735,8 +322555,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -318809,8 +322629,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -318836,7 +322656,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -318852,7 +322673,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -318875,7 +322696,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -318914,9 +322735,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -319141,9 +322963,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -319280,7 +323107,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -319504,12 +323331,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -319526,15 +323353,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -319705,25 +323534,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -319732,9 +323564,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -319779,9 +323612,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -319820,8 +323653,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -319894,8 +323727,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -319921,7 +323754,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -319937,7 +323771,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -319960,7 +323794,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -319999,9 +323833,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -320226,9 +324061,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -320365,7 +324205,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -320589,12 +324429,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -320611,15 +324451,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -320790,25 +324632,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -320817,9 +324662,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -320864,9 +324710,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -320905,8 +324751,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -320979,8 +324825,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -321006,7 +324852,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -321022,7 +324869,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -321045,7 +324892,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -321084,9 +324931,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -321311,9 +325159,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -321450,7 +325303,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -321674,12 +325527,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -321696,15 +325549,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -321875,25 +325730,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -321902,9 +325760,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -321949,9 +325808,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -321990,8 +325849,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -322064,8 +325923,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -322091,7 +325950,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -322107,7 +325967,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -322130,7 +325990,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -322169,9 +326029,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -322396,9 +326257,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -322535,7 +326401,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -322759,12 +326625,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -322781,15 +326647,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -322960,25 +326828,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -322987,9 +326858,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -323034,9 +326906,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -323075,8 +326947,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -323149,8 +327021,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -323176,7 +327048,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -323192,7 +327065,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -323215,7 +327088,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -323254,9 +327127,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -323481,9 +327355,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -323620,7 +327499,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -323844,12 +327723,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -323866,15 +327745,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -324045,25 +327926,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -324072,9 +327956,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -324119,9 +328004,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -324160,8 +328045,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -324234,8 +328119,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -324261,7 +328146,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -324277,7 +328163,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -324300,7 +328186,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -324339,9 +328225,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -324566,9 +328453,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -324705,7 +328597,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -324929,12 +328821,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -324951,15 +328843,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -325130,25 +329024,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -325157,9 +329054,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -325204,9 +329102,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -325245,8 +329143,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -325319,8 +329217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -325346,7 +329244,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -325362,7 +329261,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -325385,7 +329284,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -325424,9 +329323,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -325651,9 +329551,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -325790,7 +329695,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -326014,12 +329919,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -326036,15 +329941,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -326215,25 +330122,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -326242,9 +330152,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -326289,9 +330200,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -326330,8 +330241,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -326404,8 +330315,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -326431,7 +330342,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -326447,7 +330359,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -326470,7 +330382,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -326509,9 +330421,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -326736,9 +330649,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -326875,7 +330793,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -327099,12 +331017,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -327121,15 +331039,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -327300,25 +331220,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -327327,9 +331250,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -327374,9 +331298,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -327415,8 +331339,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -327489,8 +331413,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -327516,7 +331440,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -327532,7 +331457,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -327555,7 +331480,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -327594,9 +331519,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -327821,9 +331747,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -327960,7 +331891,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -328184,12 +332115,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -328206,15 +332137,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -328385,25 +332318,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -328412,9 +332348,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -328459,9 +332396,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -328500,8 +332437,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -328574,8 +332511,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -328601,7 +332538,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -328617,7 +332555,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -328640,7 +332578,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -328679,9 +332617,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -328906,9 +332845,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -329045,7 +332989,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -329269,12 +333213,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -329291,15 +333235,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -329470,25 +333416,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -329497,9 +333446,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -329544,9 +333494,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -329585,8 +333535,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -329659,8 +333609,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -329686,7 +333636,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -329702,7 +333653,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -329725,7 +333676,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -329764,9 +333715,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -329991,9 +333943,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -330130,7 +334087,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -330354,12 +334311,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -330376,15 +334333,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -330555,25 +334514,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -330582,9 +334544,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -330629,9 +334592,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -330670,8 +334633,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -330744,8 +334707,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -330771,7 +334734,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -330787,7 +334751,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -330810,7 +334774,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -330849,9 +334813,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -331076,9 +335041,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -331215,7 +335185,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -331439,12 +335409,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -331461,15 +335431,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -331640,25 +335612,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -331667,9 +335642,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -331714,9 +335690,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -331755,8 +335731,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -331829,8 +335805,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -331856,7 +335832,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -331872,7 +335849,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -331895,7 +335872,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -331934,9 +335911,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -332161,9 +336139,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -332300,7 +336283,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -332524,12 +336507,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -332546,15 +336529,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -332725,25 +336710,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -332752,9 +336740,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -332799,9 +336788,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -332840,8 +336829,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -332914,8 +336903,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -332941,7 +336930,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -332957,7 +336947,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -332980,7 +336970,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -333019,9 +337009,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -333246,9 +337237,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -333385,7 +337381,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -333609,12 +337605,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -333631,15 +337627,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -333810,25 +337808,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -333837,9 +337838,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -333884,9 +337886,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -333925,8 +337927,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -333999,8 +338001,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -334026,7 +338028,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -334042,7 +338045,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -334065,7 +338068,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -334104,9 +338107,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -334331,9 +338335,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -334470,7 +338479,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -334694,12 +338703,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -334716,15 +338725,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -334895,25 +338906,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -334922,9 +338936,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -334969,9 +338984,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -335010,8 +339025,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -335084,8 +339099,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -335111,7 +339126,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -335127,7 +339143,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -335150,7 +339166,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -335189,9 +339205,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -335416,9 +339433,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -335555,7 +339577,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -335779,12 +339801,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -335801,15 +339823,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -335980,25 +340004,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -336007,9 +340034,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -336054,9 +340082,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -336095,8 +340123,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -336169,8 +340197,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -336196,7 +340224,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -336212,7 +340241,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -336235,7 +340264,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -336274,9 +340303,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -336501,9 +340531,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -336640,7 +340675,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -336864,12 +340899,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -336886,15 +340921,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -337065,25 +341102,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -337092,9 +341132,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -337139,9 +341180,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -337180,8 +341221,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -337254,8 +341295,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -337281,7 +341322,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -337297,7 +341339,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -337320,7 +341362,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -337359,9 +341401,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -337586,9 +341629,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -337725,7 +341773,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -337949,12 +341997,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -337971,15 +342019,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -338150,25 +342200,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -338177,9 +342230,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -338224,9 +342278,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -338265,8 +342319,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -338339,8 +342393,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -338366,7 +342420,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -338382,7 +342437,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -338405,7 +342460,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -338444,9 +342499,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -338671,9 +342727,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -338810,7 +342871,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -339034,12 +343095,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -339056,15 +343117,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -339235,25 +343298,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -339262,9 +343328,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -339309,9 +343376,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -339350,8 +343417,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -339424,8 +343491,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -339451,7 +343518,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -339467,7 +343535,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -339490,7 +343558,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -339529,9 +343597,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -339756,9 +343825,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -339895,7 +343969,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -340119,12 +344193,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -340141,15 +344215,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -340320,25 +344396,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -340347,9 +344426,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -340394,9 +344474,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -340435,8 +344515,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -340509,8 +344589,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -340536,7 +344616,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -340552,7 +344633,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -340575,7 +344656,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -340614,9 +344695,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -340841,9 +344923,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -340980,7 +345067,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -341204,12 +345291,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -341226,15 +345313,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -341405,25 +345494,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -341432,9 +345524,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -341479,9 +345572,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -341520,8 +345613,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -341594,8 +345687,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -341621,7 +345714,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -341637,7 +345731,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -341660,7 +345754,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -341699,9 +345793,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -341926,9 +346021,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -342065,7 +346165,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -342289,12 +346389,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -342311,15 +346411,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -342490,25 +346592,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -342517,9 +346622,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -342564,9 +346670,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -342605,8 +346711,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -342679,8 +346785,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -342706,7 +346812,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -342722,7 +346829,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -342745,7 +346852,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -342784,9 +346891,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -343011,9 +347119,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -343150,7 +347263,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -343374,12 +347487,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -343396,15 +347509,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -343575,25 +347690,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -343602,9 +347720,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -343649,9 +347768,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -343690,8 +347809,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -343764,8 +347883,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -343791,7 +347910,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -343807,7 +347927,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -343830,7 +347950,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -343869,9 +347989,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -344096,9 +348217,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -344235,7 +348361,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -344459,12 +348585,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -344481,15 +348607,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -344660,25 +348788,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -344687,9 +348818,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -344734,9 +348866,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -344775,8 +348907,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -344849,8 +348981,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -344876,7 +349008,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -344892,7 +349025,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -344915,7 +349048,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -344954,9 +349087,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -345181,9 +349315,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -345320,7 +349459,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -345544,12 +349683,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -345566,15 +349705,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -345745,25 +349886,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -345772,9 +349916,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -345819,9 +349964,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -345860,8 +350005,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -345934,8 +350079,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -345961,7 +350106,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -345977,7 +350123,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -346000,7 +350146,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -346039,9 +350185,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -346266,9 +350413,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -346405,7 +350557,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -346629,12 +350781,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -346651,15 +350803,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -346830,25 +350984,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -346857,9 +351014,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -346904,9 +351062,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -346945,8 +351103,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -347019,8 +351177,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -347046,7 +351204,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -347062,7 +351221,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -347085,7 +351244,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -347124,9 +351283,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -347351,9 +351511,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -347490,7 +351655,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -347714,12 +351879,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -347736,15 +351901,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -347915,25 +352082,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -347942,9 +352112,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -347989,9 +352160,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -348030,8 +352201,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -348104,8 +352275,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -348131,7 +352302,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -348147,7 +352319,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -348170,7 +352342,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -348209,9 +352381,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -348436,9 +352609,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -348575,7 +352753,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -348799,12 +352977,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -348821,15 +352999,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -349000,25 +353180,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -349027,9 +353210,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -349074,9 +353258,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -349115,8 +353299,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -349189,8 +353373,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -349216,7 +353400,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -349232,7 +353417,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -349255,7 +353440,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -349294,9 +353479,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -349521,9 +353707,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -349660,7 +353851,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -349884,12 +354075,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -349906,15 +354097,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -350085,25 +354278,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -350112,9 +354308,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -350159,9 +354356,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -350200,8 +354397,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -350274,8 +354471,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -350301,7 +354498,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -350317,7 +354515,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -350340,7 +354538,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -350379,9 +354577,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -350606,9 +354805,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -350745,7 +354949,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -350969,12 +355173,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -350991,15 +355195,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -351170,25 +355376,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -351197,9 +355406,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -351244,9 +355454,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -351285,8 +355495,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -351359,8 +355569,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -351386,7 +355596,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -351402,7 +355613,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -351425,7 +355636,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -351464,9 +355675,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -351691,9 +355903,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -351830,7 +356047,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -352054,12 +356271,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -352076,15 +356293,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -352255,25 +356474,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -352282,9 +356504,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -352329,9 +356552,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -352370,8 +356593,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -352444,8 +356667,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -352471,7 +356694,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -352487,7 +356711,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -352510,7 +356734,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -352549,9 +356773,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -352776,9 +357001,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -352915,7 +357145,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -353139,12 +357369,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -353161,15 +357391,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -353340,25 +357572,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -353367,9 +357602,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -353414,9 +357650,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -353455,8 +357691,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -353529,8 +357765,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -353556,7 +357792,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -353572,7 +357809,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -353595,7 +357832,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -353634,9 +357871,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -353861,9 +358099,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -354000,7 +358243,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -354224,12 +358467,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -354246,15 +358489,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -354425,25 +358670,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -354452,9 +358700,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -354499,9 +358748,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -354540,8 +358789,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -354614,8 +358863,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -354641,7 +358890,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -354657,7 +358907,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -354680,7 +358930,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -354719,9 +358969,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -354946,9 +359197,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -355085,7 +359341,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -355309,12 +359565,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -355331,15 +359587,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -355510,25 +359768,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -355537,9 +359798,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -355584,9 +359846,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -355625,8 +359887,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -355699,8 +359961,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -355726,7 +359988,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -355742,7 +360005,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -355765,7 +360028,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -355804,9 +360067,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -356031,9 +360295,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -356170,7 +360439,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -356394,12 +360663,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -356416,15 +360685,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -356595,25 +360866,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -356622,9 +360896,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -356669,9 +360944,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -356710,8 +360985,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -356784,8 +361059,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -356811,7 +361086,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -356827,7 +361103,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -356850,7 +361126,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -356889,9 +361165,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -357116,9 +361393,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -357255,7 +361537,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -357479,12 +361761,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -357501,15 +361783,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -357680,25 +361964,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -357707,9 +361994,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -357754,9 +362042,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -357795,8 +362083,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -357869,8 +362157,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -357896,7 +362184,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -357912,7 +362201,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -357935,7 +362224,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -357974,9 +362263,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -358201,9 +362491,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -358340,7 +362635,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -358564,12 +362859,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -358586,15 +362881,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -358765,25 +363062,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -358792,9 +363092,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -358839,9 +363140,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -358880,8 +363181,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -358954,8 +363255,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -358981,7 +363282,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -358997,7 +363299,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -359020,7 +363322,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -359059,9 +363361,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -359286,9 +363589,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -359425,7 +363733,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -359649,12 +363957,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -359671,15 +363979,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -359850,25 +364160,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -359877,9 +364190,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -359924,9 +364238,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -359965,8 +364279,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -360039,8 +364353,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -360066,7 +364380,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -360082,7 +364397,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -360105,7 +364420,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -360144,9 +364459,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -360371,9 +364687,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -360510,7 +364831,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -360734,12 +365055,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -360756,15 +365077,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -360935,25 +365258,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -360962,9 +365288,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -361009,9 +365336,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -361050,8 +365377,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -361124,8 +365451,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -361151,7 +365478,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -361167,7 +365495,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -361190,7 +365518,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -361229,9 +365557,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -361456,9 +365785,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -361595,7 +365929,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -361819,12 +366153,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -361841,15 +366175,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -362020,25 +366356,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -362047,9 +366386,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -362094,9 +366434,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -362135,8 +366475,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -362209,8 +366549,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -362236,7 +366576,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -362252,7 +366593,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -362275,7 +366616,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -362314,9 +366655,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -362541,9 +366883,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -362680,7 +367027,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -362904,12 +367251,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -362926,15 +367273,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -363105,25 +367454,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -363132,9 +367484,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -363179,9 +367532,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -363220,8 +367573,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -363294,8 +367647,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -363321,7 +367674,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -363337,7 +367691,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -363360,7 +367714,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -363399,9 +367753,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -363626,9 +367981,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -363765,7 +368125,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -363989,12 +368349,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -364011,15 +368371,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -364190,25 +368552,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -364217,9 +368582,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -364264,9 +368630,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -364305,8 +368671,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -364379,8 +368745,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -364406,7 +368772,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -364422,7 +368789,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -364445,7 +368812,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -364484,9 +368851,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -364711,9 +369079,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -364850,7 +369223,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -365074,12 +369447,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -365096,15 +369469,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -365275,25 +369650,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -365302,9 +369680,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -365349,9 +369728,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -365390,8 +369769,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -365464,8 +369843,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -365491,7 +369870,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -365507,7 +369887,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -365530,7 +369910,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -365569,9 +369949,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -365796,9 +370177,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -365935,7 +370321,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -366159,12 +370545,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -366181,15 +370567,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -366360,25 +370748,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -366387,9 +370778,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -366434,9 +370826,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -366475,8 +370867,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -366549,8 +370941,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -366576,7 +370968,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -366592,7 +370985,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -366615,7 +371008,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -366654,9 +371047,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -366881,9 +371275,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -367020,7 +371419,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -367244,12 +371643,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -367266,15 +371665,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -367445,25 +371846,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -367472,9 +371876,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -367519,9 +371924,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -367560,8 +371965,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -367634,8 +372039,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -367661,7 +372066,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -367677,7 +372083,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -367700,7 +372106,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -367739,9 +372145,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -367966,9 +372373,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -368105,7 +372517,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -368329,12 +372741,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -368351,15 +372763,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -368530,25 +372944,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -368557,9 +372974,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -368604,9 +373022,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -368645,8 +373063,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -368719,8 +373137,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -368746,7 +373164,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -368762,7 +373181,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -368785,7 +373204,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -368824,9 +373243,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -369051,9 +373471,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -369190,7 +373615,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -369414,12 +373839,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -369436,15 +373861,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -369615,25 +374042,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -369642,9 +374072,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -369689,9 +374120,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -369730,8 +374161,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -369804,8 +374235,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -369831,7 +374262,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -369847,7 +374279,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -369870,7 +374302,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -369909,9 +374341,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -370136,9 +374569,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -370275,7 +374713,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -370499,12 +374937,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -370521,15 +374959,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -370700,25 +375140,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -370727,9 +375170,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -370774,9 +375218,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -370815,8 +375259,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -370889,8 +375333,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -370916,7 +375360,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -370932,7 +375377,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -370955,7 +375400,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -370994,9 +375439,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -371221,9 +375667,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -371360,7 +375811,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -371584,12 +376035,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -371606,15 +376057,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -371785,25 +376238,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -371812,9 +376268,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -371859,9 +376316,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -371900,8 +376357,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -371974,8 +376431,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -372001,7 +376458,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -372017,7 +376475,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -372040,7 +376498,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -372079,9 +376537,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -372306,9 +376765,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -372445,7 +376909,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -372669,12 +377133,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -372691,15 +377155,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -372870,25 +377336,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -372897,9 +377366,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -372944,9 +377414,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -372985,8 +377455,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -373059,8 +377529,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -373086,7 +377556,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -373102,7 +377573,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -373125,7 +377596,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -373164,9 +377635,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -373391,9 +377863,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -373530,7 +378007,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -373754,12 +378231,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -373776,15 +378253,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -373955,25 +378434,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -373982,9 +378464,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -374029,9 +378512,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -374070,8 +378553,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -374144,8 +378627,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -374171,7 +378654,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -374187,7 +378671,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -374210,7 +378694,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -374249,9 +378733,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -374476,9 +378961,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -374615,7 +379105,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -374839,12 +379329,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -374861,15 +379351,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -375040,25 +379532,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -375067,9 +379562,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -375114,9 +379610,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -375155,8 +379651,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -375229,8 +379725,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -375256,7 +379752,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -375272,7 +379769,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -375295,7 +379792,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -375334,9 +379831,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -375561,9 +380059,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -375700,7 +380203,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -375924,12 +380427,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -375946,15 +380449,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -376125,25 +380630,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -376152,9 +380660,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -376199,9 +380708,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -376240,8 +380749,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -376314,8 +380823,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -376341,7 +380850,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -376357,7 +380867,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -376380,7 +380890,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -376419,9 +380929,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -376646,9 +381157,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -376785,7 +381301,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -377009,12 +381525,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -377031,15 +381547,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -377210,25 +381728,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -377237,9 +381758,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -377284,9 +381806,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -377325,8 +381847,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -377399,8 +381921,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -377426,7 +381948,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -377442,7 +381965,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -377465,7 +381988,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -377504,9 +382027,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -377731,9 +382255,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -377870,7 +382399,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -378094,12 +382623,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -378116,15 +382645,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -378295,25 +382826,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -378322,9 +382856,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -378369,9 +382904,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -378410,8 +382945,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -378484,8 +383019,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -378511,7 +383046,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -378527,7 +383063,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -378550,7 +383086,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -378589,9 +383125,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -378816,9 +383353,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -378955,7 +383497,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -379179,12 +383721,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -379201,15 +383743,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -379380,25 +383924,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -379407,9 +383954,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -379454,9 +384002,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -379495,8 +384043,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -379569,8 +384117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -379596,7 +384144,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -379612,7 +384161,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -379635,7 +384184,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -379674,9 +384223,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -379901,9 +384451,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -380040,7 +384595,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -380264,12 +384819,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -380286,15 +384841,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -380465,25 +385022,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -380492,9 +385052,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -380539,9 +385100,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -380580,8 +385141,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -380654,8 +385215,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -380681,7 +385242,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -380697,7 +385259,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -380720,7 +385282,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -380759,9 +385321,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -380986,9 +385549,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -381125,7 +385693,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -381349,12 +385917,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -381371,15 +385939,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -381550,25 +386120,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -381577,9 +386150,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -381624,9 +386198,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -381665,8 +386239,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -381739,8 +386313,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -381766,7 +386340,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -381782,7 +386357,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -381805,7 +386380,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -381844,9 +386419,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -382071,9 +386647,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -382210,7 +386791,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -382434,12 +387015,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -382456,15 +387037,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -382635,25 +387218,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -382662,9 +387248,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -382709,9 +387296,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -382750,8 +387337,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -382824,8 +387411,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -382851,7 +387438,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -382867,7 +387455,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -382890,7 +387478,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -382929,9 +387517,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -383156,9 +387745,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -383295,7 +387889,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -383519,12 +388113,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -383541,15 +388135,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -383720,25 +388316,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -383747,9 +388346,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -383794,9 +388394,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -383835,8 +388435,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -383909,8 +388509,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -383936,7 +388536,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -383952,7 +388553,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -383975,7 +388576,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -384014,9 +388615,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -384241,9 +388843,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -384380,7 +388987,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -384604,12 +389211,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -384626,15 +389233,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -384805,25 +389414,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -384832,9 +389444,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -384879,9 +389492,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -384920,8 +389533,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -384994,8 +389607,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -385021,7 +389634,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -385037,7 +389651,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -385060,7 +389674,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -385099,9 +389713,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -385326,9 +389941,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -385465,7 +390085,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -385689,12 +390309,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -385711,15 +390331,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -385890,25 +390512,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -385917,9 +390542,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -385964,9 +390590,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -386005,8 +390631,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -386079,8 +390705,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -386106,7 +390732,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -386122,7 +390749,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -386145,7 +390772,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -386184,9 +390811,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -386411,9 +391039,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -386550,7 +391183,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -386774,12 +391407,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -386796,15 +391429,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -386975,25 +391610,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -387002,9 +391640,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -387049,9 +391688,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -387090,8 +391729,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -387164,8 +391803,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -387191,7 +391830,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -387207,7 +391847,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -387230,7 +391870,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -387269,9 +391909,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -387496,9 +392137,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -387635,7 +392281,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -387859,12 +392505,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -387881,15 +392527,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -388060,25 +392708,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -388087,9 +392738,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -388134,9 +392786,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -388175,8 +392827,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -388249,8 +392901,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -388276,7 +392928,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -388292,7 +392945,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -388315,7 +392968,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -388354,9 +393007,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -388581,9 +393235,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -388720,7 +393379,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -388944,12 +393603,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -388966,15 +393625,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -389145,25 +393806,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -389172,9 +393836,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -389219,9 +393884,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -389260,8 +393925,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -389334,8 +393999,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -389361,7 +394026,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -389377,7 +394043,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -389400,7 +394066,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -389439,9 +394105,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -389666,9 +394333,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -389805,7 +394477,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -390029,12 +394701,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -390051,15 +394723,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -390230,25 +394904,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -390257,9 +394934,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -390304,9 +394982,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -390345,8 +395023,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -390419,8 +395097,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -390446,7 +395124,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -390462,7 +395141,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -390485,7 +395164,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -390524,9 +395203,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -390751,9 +395431,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -390890,7 +395575,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -391114,12 +395799,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -391136,15 +395821,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -391315,25 +396002,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -391342,9 +396032,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -391389,9 +396080,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -391430,8 +396121,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -391504,8 +396195,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -391531,7 +396222,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -391547,7 +396239,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -391570,7 +396262,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -391609,9 +396301,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -391836,9 +396529,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -391975,7 +396673,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -392199,12 +396897,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -392221,15 +396919,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -392400,25 +397100,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -392427,9 +397130,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -392474,9 +397178,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -392515,8 +397219,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -392589,8 +397293,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -392616,7 +397320,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -392632,7 +397337,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -392655,7 +397360,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -392694,9 +397399,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -392921,9 +397627,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -393060,7 +397771,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -393284,12 +397995,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -393306,15 +398017,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -393485,25 +398198,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -393512,9 +398228,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -393559,9 +398276,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -393600,8 +398317,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -393674,8 +398391,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -393701,7 +398418,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -393717,7 +398435,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -393740,7 +398458,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -393779,9 +398497,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -394006,9 +398725,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -394145,7 +398869,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -394369,12 +399093,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -394391,15 +399115,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -394570,25 +399296,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -394597,9 +399326,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -394644,9 +399374,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -394685,8 +399415,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -394759,8 +399489,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -394786,7 +399516,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -394802,7 +399533,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -394825,7 +399556,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -394864,9 +399595,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -395091,9 +399823,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -395230,7 +399967,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -395454,12 +400191,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -395476,15 +400213,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -395655,25 +400394,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -395682,9 +400424,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -395729,9 +400472,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -395770,8 +400513,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -395844,8 +400587,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -395871,7 +400614,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -395887,7 +400631,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -395910,7 +400654,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -395949,9 +400693,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -396176,9 +400921,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -396315,7 +401065,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -396539,12 +401289,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -396561,15 +401311,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -396740,25 +401492,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -396767,9 +401522,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -396814,9 +401570,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -396855,8 +401611,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -396929,8 +401685,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -396956,7 +401712,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -396972,7 +401729,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -396995,7 +401752,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -397034,9 +401791,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -397261,9 +402019,14 @@ T1013,No,-,0
 T1600,No,-,0
 T1606.002,No,-,0
 T1192,No,-,0
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,3
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,3
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_service_stop_attempt.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_delete_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempt_to_disable_services.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___delete_a_net_user.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___disable_net_user_account.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___resize_shadowstorage_volume.yml,8
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_security_account_manager_stopped.yml,8
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
@@ -397400,7 +402163,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,31
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -397624,12 +402387,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,28
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,28
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -397646,15 +402409,17 @@ T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,4
-T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,4
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_spike_in_network_acl_activity.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml,6
+T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml,6
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,11
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,11
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -397825,25 +402590,28 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,22
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,22
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -397852,9 +402620,10 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml,3
 T1584.006,No,-,0
 T1601,No,-,0
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
-T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
+T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
 T1204.003,No,-,0
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
@@ -397899,9 +402668,9 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,5
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,5
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -397940,8 +402709,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -398014,8 +402783,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -398041,7 +402810,8 @@ T1556.001,No,-,0
 T1537,No,-,0
 T1130,No,-,0
 T1022,No,-,0
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,2
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
 T1498,No,-,0
 T1595.001,No,-,0
@@ -398057,7 +402827,7 @@ T1111,No,-,0
 T1159,No,-,0
 T1027.002,No,-,0
 T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml,1
-T1059.005,No,-,0
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execute_javascript_with_jscript_com_clsid.yml,1
 T1564.005,No,-,0
 T1543.002,No,-,0
 T1563.002,No,-,0
@@ -398080,7 +402850,7 @@ T1547.007,No,-,0
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml,2
 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_pass_hash.yml,2
 T1052,No,-,0
-T1574.002,No,-,0
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/msmpeng_application_dll_side_loading.yml,1
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bitsadmin_download_file.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_urlcache_and_split_arguments.yml,4
 T1105,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml,4
@@ -398119,9 +402889,10 @@ T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml,4
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,4
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index 25105f8c1b..ed7528729c 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -183,8 +183,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -350,7 +350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -630,7 +630,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -651,15 +651,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -875,8 +875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -890,13 +890,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -922,7 +922,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -981,7 +981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -1080,7 +1080,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -1111,8 +1111,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -1138,7 +1138,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -1181,7 +1185,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -1228,8 +1236,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -1483,8 +1491,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -1650,7 +1658,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -1930,7 +1938,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -1951,15 +1959,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -2175,8 +2183,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -2190,13 +2198,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -2222,7 +2230,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -2281,7 +2289,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -2380,7 +2388,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -2411,8 +2419,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -2438,7 +2446,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -2481,7 +2493,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -2528,8 +2544,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -2783,8 +2799,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -2950,7 +2966,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -3230,7 +3246,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -3251,15 +3267,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -3475,8 +3491,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -3490,13 +3506,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -3522,7 +3538,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -3581,7 +3597,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -3680,7 +3696,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -3711,8 +3727,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -3738,7 +3754,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -3781,7 +3801,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -3828,8 +3852,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -4083,8 +4107,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -4250,7 +4274,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -4530,7 +4554,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -4551,15 +4575,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -4775,8 +4799,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -4790,13 +4814,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -4822,7 +4846,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -4881,7 +4905,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -4980,7 +5004,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -5011,8 +5035,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -5038,7 +5062,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -5081,7 +5109,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -5128,8 +5160,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -5383,8 +5415,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -5550,7 +5582,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -5830,7 +5862,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -5851,15 +5883,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -6075,8 +6107,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -6090,13 +6122,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -6122,7 +6154,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -6181,7 +6213,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -6280,7 +6312,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -6311,8 +6343,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -6338,7 +6370,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -6381,7 +6417,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -6428,8 +6468,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -6683,8 +6723,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -6850,7 +6890,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -7130,7 +7170,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -7151,15 +7191,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -7375,8 +7415,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -7390,13 +7430,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -7422,7 +7462,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -7481,7 +7521,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -7580,7 +7620,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -7611,8 +7651,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -7638,7 +7678,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -7681,7 +7725,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -7728,8 +7776,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -7983,8 +8031,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -8150,7 +8198,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -8430,7 +8478,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -8451,15 +8499,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -8675,8 +8723,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -8690,13 +8738,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -8722,7 +8770,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -8781,7 +8829,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -8880,7 +8928,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -8911,8 +8959,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -8938,7 +8986,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -8981,7 +9033,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -9028,8 +9084,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -9283,8 +9339,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -9450,7 +9506,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -9730,7 +9786,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -9751,15 +9807,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -9975,8 +10031,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -9990,13 +10046,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -10022,7 +10078,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -10081,7 +10137,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -10180,7 +10236,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -10211,8 +10267,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -10238,7 +10294,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -10281,7 +10341,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -10328,8 +10392,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -10583,8 +10647,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -10750,7 +10814,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -11030,7 +11094,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -11051,15 +11115,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -11275,8 +11339,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -11290,13 +11354,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -11322,7 +11386,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -11381,7 +11445,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -11480,7 +11544,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -11511,8 +11575,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -11538,7 +11602,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -11581,7 +11649,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -11628,8 +11700,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -11883,8 +11955,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -12050,7 +12122,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -12330,7 +12402,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -12351,15 +12423,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -12575,8 +12647,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -12590,13 +12662,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -12622,7 +12694,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -12681,7 +12753,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -12780,7 +12852,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -12811,8 +12883,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -12838,7 +12910,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -12881,7 +12957,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -12928,8 +13008,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -13183,8 +13263,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -13350,7 +13430,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -13630,7 +13710,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -13651,15 +13731,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -13875,8 +13955,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -13890,13 +13970,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -13922,7 +14002,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -13981,7 +14061,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -14080,7 +14160,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -14111,8 +14191,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -14138,7 +14218,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -14181,7 +14265,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -14228,8 +14316,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -14483,8 +14571,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -14650,7 +14738,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -14930,7 +15018,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -14951,15 +15039,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -15175,8 +15263,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -15190,13 +15278,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -15222,7 +15310,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -15281,7 +15369,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -15380,7 +15468,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -15411,8 +15499,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -15438,7 +15526,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -15481,7 +15573,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -15528,8 +15624,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -15783,8 +15879,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -15950,7 +16046,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -16230,7 +16326,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -16251,15 +16347,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -16475,8 +16571,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -16490,13 +16586,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -16522,7 +16618,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -16581,7 +16677,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -16680,7 +16776,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -16711,8 +16807,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -16738,7 +16834,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -16781,7 +16881,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -16828,8 +16932,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -17083,8 +17187,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -17250,7 +17354,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -17530,7 +17634,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -17551,15 +17655,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -17775,8 +17879,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -17790,13 +17894,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -17822,7 +17926,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -17881,7 +17985,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -17980,7 +18084,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -18011,8 +18115,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -18038,7 +18142,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -18081,7 +18189,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -18128,8 +18240,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -18383,8 +18495,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -18550,7 +18662,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -18830,7 +18942,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -18851,15 +18963,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -19075,8 +19187,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -19090,13 +19202,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -19122,7 +19234,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -19181,7 +19293,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -19280,7 +19392,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -19311,8 +19423,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -19338,7 +19450,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -19381,7 +19497,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -19428,8 +19548,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -19683,8 +19803,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -19850,7 +19970,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -20130,7 +20250,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -20151,15 +20271,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -20375,8 +20495,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -20390,13 +20510,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -20422,7 +20542,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -20481,7 +20601,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -20580,7 +20700,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -20611,8 +20731,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -20638,7 +20758,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -20681,7 +20805,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -20728,8 +20856,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -20983,8 +21111,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -21150,7 +21278,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -21430,7 +21558,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -21451,15 +21579,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -21675,8 +21803,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -21690,13 +21818,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -21722,7 +21850,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -21781,7 +21909,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -21880,7 +22008,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -21911,8 +22039,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -21938,7 +22066,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -21981,7 +22113,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -22028,8 +22164,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -22283,8 +22419,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -22450,7 +22586,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -22730,7 +22866,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -22751,15 +22887,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -22975,8 +23111,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -22990,13 +23126,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -23022,7 +23158,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -23081,7 +23217,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -23180,7 +23316,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -23211,8 +23347,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -23238,7 +23374,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -23281,7 +23421,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -23328,8 +23472,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -23583,8 +23727,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -23750,7 +23894,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -24030,7 +24174,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -24051,15 +24195,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -24275,8 +24419,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -24290,13 +24434,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -24322,7 +24466,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -24381,7 +24525,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -24480,7 +24624,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -24511,8 +24655,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -24538,7 +24682,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -24581,7 +24729,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -24628,8 +24780,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -24883,8 +25035,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -25050,7 +25202,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -25330,7 +25482,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -25351,15 +25503,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -25575,8 +25727,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -25590,13 +25742,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -25622,7 +25774,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -25681,7 +25833,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -25780,7 +25932,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -25811,8 +25963,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -25838,7 +25990,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -25881,7 +26037,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -25928,8 +26088,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -26183,8 +26343,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -26350,7 +26510,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -26630,7 +26790,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -26651,15 +26811,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -26875,8 +27035,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -26890,13 +27050,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -26922,7 +27082,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -26981,7 +27141,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -27080,7 +27240,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -27111,8 +27271,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -27138,7 +27298,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -27181,7 +27345,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -27228,8 +27396,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -27483,8 +27651,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -27650,7 +27818,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -27930,7 +28098,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -27951,15 +28119,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -28175,8 +28343,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -28190,13 +28358,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -28222,7 +28390,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -28281,7 +28449,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -28380,7 +28548,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -28411,8 +28579,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -28438,7 +28606,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -28481,7 +28653,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -28528,8 +28704,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -28783,8 +28959,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -28950,7 +29126,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -29230,7 +29406,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -29251,15 +29427,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -29475,8 +29651,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -29490,13 +29666,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -29522,7 +29698,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -29581,7 +29757,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -29680,7 +29856,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -29711,8 +29887,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -29738,7 +29914,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -29781,7 +29961,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -29828,8 +30012,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -30083,8 +30267,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -30250,7 +30434,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -30530,7 +30714,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -30551,15 +30735,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -30775,8 +30959,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -30790,13 +30974,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -30822,7 +31006,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -30881,7 +31065,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -30980,7 +31164,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -31011,8 +31195,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -31038,7 +31222,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -31081,7 +31269,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -31128,8 +31320,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -31383,8 +31575,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -31550,7 +31742,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -31830,7 +32022,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -31851,15 +32043,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -32075,8 +32267,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -32090,13 +32282,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -32122,7 +32314,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -32181,7 +32373,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -32280,7 +32472,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -32311,8 +32503,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -32338,7 +32530,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -32381,7 +32577,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -32428,8 +32628,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -32683,8 +32883,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -32850,7 +33050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -33130,7 +33330,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -33151,15 +33351,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -33375,8 +33575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -33390,13 +33590,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -33422,7 +33622,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -33481,7 +33681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -33580,7 +33780,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -33611,8 +33811,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -33638,7 +33838,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -33681,7 +33885,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -33728,8 +33936,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -33983,8 +34191,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -34150,7 +34358,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -34430,7 +34638,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -34451,15 +34659,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -34675,8 +34883,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -34690,13 +34898,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -34722,7 +34930,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -34781,7 +34989,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -34880,7 +35088,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -34911,8 +35119,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -34938,7 +35146,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -34981,7 +35193,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -35028,8 +35244,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -35283,8 +35499,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -35450,7 +35666,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -35730,7 +35946,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -35751,15 +35967,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -35975,8 +36191,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -35990,13 +36206,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -36022,7 +36238,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -36081,7 +36297,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -36180,7 +36396,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -36211,8 +36427,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -36238,7 +36454,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -36281,7 +36501,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -36328,8 +36552,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -36583,8 +36807,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -36750,7 +36974,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -37030,7 +37254,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -37051,15 +37275,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -37275,8 +37499,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -37290,13 +37514,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -37322,7 +37546,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -37381,7 +37605,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -37480,7 +37704,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -37511,8 +37735,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -37538,7 +37762,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -37581,7 +37809,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -37628,8 +37860,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -37883,8 +38115,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -38050,7 +38282,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -38330,7 +38562,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -38351,15 +38583,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -38575,8 +38807,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -38590,13 +38822,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -38622,7 +38854,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -38681,7 +38913,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -38780,7 +39012,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -38811,8 +39043,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -38838,7 +39070,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -38881,7 +39117,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -38928,8 +39168,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -39183,8 +39423,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -39350,7 +39590,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -39630,7 +39870,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -39651,15 +39891,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -39875,8 +40115,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -39890,13 +40130,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -39922,7 +40162,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -39981,7 +40221,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -40080,7 +40320,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -40111,8 +40351,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -40138,7 +40378,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -40181,7 +40425,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -40228,8 +40476,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -40483,8 +40731,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -40650,7 +40898,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -40930,7 +41178,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -40951,15 +41199,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -41175,8 +41423,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -41190,13 +41438,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -41222,7 +41470,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -41281,7 +41529,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -41380,7 +41628,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -41411,8 +41659,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -41438,7 +41686,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -41481,7 +41733,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -41528,8 +41784,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -41783,8 +42039,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -41950,7 +42206,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -42230,7 +42486,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -42251,15 +42507,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -42475,8 +42731,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -42490,13 +42746,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -42522,7 +42778,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -42581,7 +42837,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -42680,7 +42936,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -42711,8 +42967,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -42738,7 +42994,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -42781,7 +43041,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -42828,8 +43092,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -43083,8 +43347,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -43250,7 +43514,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -43530,7 +43794,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -43551,15 +43815,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -43775,8 +44039,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -43790,13 +44054,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -43822,7 +44086,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -43881,7 +44145,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -43980,7 +44244,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -44011,8 +44275,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -44038,7 +44302,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -44081,7 +44349,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -44128,8 +44400,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -44383,8 +44655,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -44550,7 +44822,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -44830,7 +45102,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -44851,15 +45123,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -45075,8 +45347,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -45090,13 +45362,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -45122,7 +45394,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -45181,7 +45453,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -45280,7 +45552,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -45311,8 +45583,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -45338,7 +45610,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -45381,7 +45657,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -45428,8 +45708,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -45683,8 +45963,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -45850,7 +46130,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -46130,7 +46410,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -46151,15 +46431,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -46375,8 +46655,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -46390,13 +46670,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -46422,7 +46702,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -46481,7 +46761,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -46580,7 +46860,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -46611,8 +46891,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -46638,7 +46918,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -46681,7 +46965,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -46728,8 +47016,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -46983,8 +47271,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -47150,7 +47438,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -47430,7 +47718,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -47451,15 +47739,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -47675,8 +47963,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -47690,13 +47978,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -47722,7 +48010,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -47781,7 +48069,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -47880,7 +48168,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -47911,8 +48199,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -47938,7 +48226,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -47981,7 +48273,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -48028,8 +48324,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -48283,8 +48579,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -48450,7 +48746,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -48730,7 +49026,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -48751,15 +49047,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -48975,8 +49271,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -48990,13 +49286,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -49022,7 +49318,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -49081,7 +49377,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -49180,7 +49476,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -49211,8 +49507,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -49238,7 +49534,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -49281,7 +49581,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -49328,8 +49632,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -49583,8 +49887,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -49750,7 +50054,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -50030,7 +50334,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -50051,15 +50355,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -50275,8 +50579,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -50290,13 +50594,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -50322,7 +50626,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -50381,7 +50685,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -50480,7 +50784,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -50511,8 +50815,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -50538,7 +50842,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -50581,7 +50889,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -50628,8 +50940,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -50883,8 +51195,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -51050,7 +51362,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -51330,7 +51642,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -51351,15 +51663,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -51575,8 +51887,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -51590,13 +51902,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -51622,7 +51934,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -51681,7 +51993,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -51780,7 +52092,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -51811,8 +52123,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -51838,7 +52150,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -51881,7 +52197,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -51928,8 +52248,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -52183,8 +52503,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -52350,7 +52670,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -52630,7 +52950,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -52651,15 +52971,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -52875,8 +53195,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -52890,13 +53210,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -52922,7 +53242,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -52981,7 +53301,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -53080,7 +53400,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -53111,8 +53431,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -53138,7 +53458,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -53181,7 +53505,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -53228,8 +53556,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -53483,8 +53811,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -53650,7 +53978,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -53930,7 +54258,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -53951,15 +54279,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -54175,8 +54503,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -54190,13 +54518,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -54222,7 +54550,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -54281,7 +54609,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -54380,7 +54708,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -54411,8 +54739,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -54438,7 +54766,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -54481,7 +54813,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -54528,8 +54864,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -54783,8 +55119,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -54950,7 +55286,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -55230,7 +55566,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -55251,15 +55587,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -55475,8 +55811,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -55490,13 +55826,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -55522,7 +55858,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -55581,7 +55917,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -55680,7 +56016,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -55711,8 +56047,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -55738,7 +56074,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -55781,7 +56121,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -55828,8 +56172,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -56083,8 +56427,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -56250,7 +56594,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -56530,7 +56874,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -56551,15 +56895,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -56775,8 +57119,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -56790,13 +57134,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -56822,7 +57166,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -56881,7 +57225,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -56980,7 +57324,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -57011,8 +57355,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -57038,7 +57382,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -57081,7 +57429,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -57128,8 +57480,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -57383,8 +57735,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -57550,7 +57902,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -57830,7 +58182,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -57851,15 +58203,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -58075,8 +58427,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -58090,13 +58442,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -58122,7 +58474,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -58181,7 +58533,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -58280,7 +58632,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -58311,8 +58663,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -58338,7 +58690,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -58381,7 +58737,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -58428,8 +58788,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -58683,8 +59043,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -58850,7 +59210,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -59130,7 +59490,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -59151,15 +59511,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -59375,8 +59735,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -59390,13 +59750,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -59422,7 +59782,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -59481,7 +59841,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -59580,7 +59940,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -59611,8 +59971,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -59638,7 +59998,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -59681,7 +60045,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -59728,8 +60096,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -59983,8 +60351,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -60150,7 +60518,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -60430,7 +60798,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -60451,15 +60819,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -60675,8 +61043,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -60690,13 +61058,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -60722,7 +61090,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -60781,7 +61149,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -60880,7 +61248,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -60911,8 +61279,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -60938,7 +61306,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -60981,7 +61353,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -61028,8 +61404,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -61283,8 +61659,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -61450,7 +61826,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -61730,7 +62106,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -61751,15 +62127,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -61975,8 +62351,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -61990,13 +62366,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -62022,7 +62398,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -62081,7 +62457,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -62180,7 +62556,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -62211,8 +62587,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -62238,7 +62614,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -62281,7 +62661,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -62328,8 +62712,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -62583,8 +62967,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -62750,7 +63134,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -63030,7 +63414,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -63051,15 +63435,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -63275,8 +63659,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -63290,13 +63674,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -63322,7 +63706,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -63381,7 +63765,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -63480,7 +63864,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -63511,8 +63895,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -63538,7 +63922,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -63581,7 +63969,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -63628,8 +64020,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -63883,8 +64275,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -64050,7 +64442,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -64330,7 +64722,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -64351,15 +64743,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -64575,8 +64967,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -64590,13 +64982,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -64622,7 +65014,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -64681,7 +65073,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -64780,7 +65172,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -64811,8 +65203,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -64838,7 +65230,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -64881,7 +65277,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -64928,8 +65328,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -65183,8 +65583,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -65350,7 +65750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -65630,7 +66030,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -65651,15 +66051,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -65875,8 +66275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -65890,13 +66290,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -65922,7 +66322,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -65981,7 +66381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -66080,7 +66480,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -66111,8 +66511,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -66138,7 +66538,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -66181,7 +66585,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -66228,8 +66636,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -66483,8 +66891,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -66650,7 +67058,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -66930,7 +67338,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -66951,15 +67359,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -67175,8 +67583,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -67190,13 +67598,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -67222,7 +67630,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -67281,7 +67689,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -67380,7 +67788,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -67411,8 +67819,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -67438,7 +67846,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -67481,7 +67893,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -67528,8 +67944,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -67783,8 +68199,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -67950,7 +68366,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -68230,7 +68646,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -68251,15 +68667,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -68475,8 +68891,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -68490,13 +68906,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -68522,7 +68938,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -68581,7 +68997,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -68680,7 +69096,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -68711,8 +69127,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -68738,7 +69154,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -68781,7 +69201,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -68828,8 +69252,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -69083,8 +69507,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -69250,7 +69674,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -69530,7 +69954,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -69551,15 +69975,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -69775,8 +70199,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -69790,13 +70214,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -69822,7 +70246,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -69881,7 +70305,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -69980,7 +70404,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -70011,8 +70435,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -70038,7 +70462,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -70081,7 +70509,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -70128,8 +70560,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -70383,8 +70815,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -70550,7 +70982,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -70830,7 +71262,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -70851,15 +71283,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -71075,8 +71507,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -71090,13 +71522,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -71122,7 +71554,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -71181,7 +71613,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -71280,7 +71712,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -71311,8 +71743,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -71338,7 +71770,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -71381,7 +71817,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -71428,8 +71868,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -71683,8 +72123,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -71850,7 +72290,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -72130,7 +72570,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -72151,15 +72591,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -72375,8 +72815,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -72390,13 +72830,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -72422,7 +72862,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -72481,7 +72921,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -72580,7 +73020,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -72611,8 +73051,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -72638,7 +73078,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -72681,7 +73125,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -72728,8 +73176,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -72983,8 +73431,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -73150,7 +73598,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -73430,7 +73878,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -73451,15 +73899,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -73675,8 +74123,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -73690,13 +74138,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -73722,7 +74170,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -73781,7 +74229,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -73880,7 +74328,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -73911,8 +74359,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -73938,7 +74386,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -73981,7 +74433,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -74028,8 +74484,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -74283,8 +74739,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -74450,7 +74906,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -74730,7 +75186,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -74751,15 +75207,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -74975,8 +75431,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -74990,13 +75446,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -75022,7 +75478,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -75081,7 +75537,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -75180,7 +75636,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -75211,8 +75667,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -75238,7 +75694,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -75281,7 +75741,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -75328,8 +75792,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -75583,8 +76047,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -75750,7 +76214,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -76030,7 +76494,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -76051,15 +76515,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -76275,8 +76739,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -76290,13 +76754,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -76322,7 +76786,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -76381,7 +76845,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -76480,7 +76944,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -76511,8 +76975,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -76538,7 +77002,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -76581,7 +77049,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -76628,8 +77100,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -76883,8 +77355,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -77050,7 +77522,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -77330,7 +77802,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -77351,15 +77823,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -77575,8 +78047,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -77590,13 +78062,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -77622,7 +78094,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -77681,7 +78153,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -77780,7 +78252,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -77811,8 +78283,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77838,7 +78310,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -77881,7 +78357,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -77928,8 +78408,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -78183,8 +78663,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -78350,7 +78830,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -78630,7 +79110,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -78651,15 +79131,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -78875,8 +79355,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -78890,13 +79370,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -78922,7 +79402,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -78981,7 +79461,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -79080,7 +79560,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -79111,8 +79591,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79138,7 +79618,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -79181,7 +79665,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -79228,8 +79716,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -79483,8 +79971,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -79650,7 +80138,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -79930,7 +80418,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -79951,15 +80439,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -80175,8 +80663,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -80190,13 +80678,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -80222,7 +80710,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -80281,7 +80769,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -80380,7 +80868,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -80411,8 +80899,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80438,7 +80926,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -80481,7 +80973,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -80528,8 +81024,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -80783,8 +81279,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -80950,7 +81446,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -81230,7 +81726,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -81251,15 +81747,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -81475,8 +81971,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -81490,13 +81986,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -81522,7 +82018,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -81581,7 +82077,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -81680,7 +82176,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -81711,8 +82207,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81738,7 +82234,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -81781,7 +82281,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -81828,8 +82332,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -82083,8 +82587,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -82250,7 +82754,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -82530,7 +83034,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -82551,15 +83055,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -82775,8 +83279,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -82790,13 +83294,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -82822,7 +83326,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -82881,7 +83385,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -82980,7 +83484,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -83011,8 +83515,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -83038,7 +83542,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -83081,7 +83589,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -83128,8 +83640,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -83383,8 +83895,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -83550,7 +84062,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -83830,7 +84342,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -83851,15 +84363,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -84075,8 +84587,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -84090,13 +84602,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -84122,7 +84634,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -84181,7 +84693,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -84280,7 +84792,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -84311,8 +84823,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -84338,7 +84850,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -84381,7 +84897,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -84428,8 +84948,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -84683,8 +85203,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -84850,7 +85370,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -85130,7 +85650,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -85151,15 +85671,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -85375,8 +85895,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -85390,13 +85910,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -85422,7 +85942,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -85481,7 +86001,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -85580,7 +86100,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -85611,8 +86131,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -85638,7 +86158,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -85681,7 +86205,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -85728,8 +86256,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -85983,8 +86511,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -86150,7 +86678,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -86430,7 +86958,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -86451,15 +86979,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -86675,8 +87203,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -86690,13 +87218,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -86722,7 +87250,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -86781,7 +87309,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -86880,7 +87408,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -86911,8 +87439,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -86938,7 +87466,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -86981,7 +87513,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -87028,8 +87564,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -87283,8 +87819,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -87450,7 +87986,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -87730,7 +88266,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -87751,15 +88287,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -87975,8 +88511,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -87990,13 +88526,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -88022,7 +88558,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -88081,7 +88617,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -88180,7 +88716,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -88211,8 +88747,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -88238,7 +88774,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -88281,7 +88821,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -88328,8 +88872,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -88583,8 +89127,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -88750,7 +89294,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -89030,7 +89574,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -89051,15 +89595,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -89275,8 +89819,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -89290,13 +89834,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -89322,7 +89866,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -89381,7 +89925,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -89480,7 +90024,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -89511,8 +90055,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -89538,7 +90082,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -89581,7 +90129,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -89628,8 +90180,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -89883,8 +90435,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -90050,7 +90602,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -90330,7 +90882,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -90351,15 +90903,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -90575,8 +91127,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -90590,13 +91142,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -90622,7 +91174,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -90681,7 +91233,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -90780,7 +91332,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -90811,8 +91363,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -90838,7 +91390,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -90881,7 +91437,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -90928,8 +91488,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -91183,8 +91743,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -91350,7 +91910,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -91630,7 +92190,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -91651,15 +92211,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -91875,8 +92435,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -91890,13 +92450,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -91922,7 +92482,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -91981,7 +92541,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -92080,7 +92640,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -92111,8 +92671,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -92138,7 +92698,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -92181,7 +92745,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -92228,8 +92796,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -92483,8 +93051,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -92650,7 +93218,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -92930,7 +93498,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -92951,15 +93519,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -93175,8 +93743,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -93190,13 +93758,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -93222,7 +93790,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -93281,7 +93849,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -93380,7 +93948,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -93411,8 +93979,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -93438,7 +94006,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -93481,7 +94053,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -93528,8 +94104,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -93783,8 +94359,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -93950,7 +94526,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -94230,7 +94806,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -94251,15 +94827,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -94475,8 +95051,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -94490,13 +95066,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -94522,7 +95098,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -94581,7 +95157,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -94680,7 +95256,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -94711,8 +95287,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -94738,7 +95314,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -94781,7 +95361,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -94828,8 +95412,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -95083,8 +95667,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -95250,7 +95834,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -95530,7 +96114,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -95551,15 +96135,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -95775,8 +96359,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -95790,13 +96374,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -95822,7 +96406,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -95881,7 +96465,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -95980,7 +96564,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -96011,8 +96595,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -96038,7 +96622,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -96081,7 +96669,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -96128,8 +96720,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -96383,8 +96975,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -96550,7 +97142,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -96830,7 +97422,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -96851,15 +97443,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -97075,8 +97667,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -97090,13 +97682,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -97122,7 +97714,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -97181,7 +97773,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -97280,7 +97872,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -97311,8 +97903,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -97338,7 +97930,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -97381,7 +97977,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -97428,8 +98028,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -97683,8 +98283,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -97850,7 +98450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -98130,7 +98730,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -98151,15 +98751,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -98375,8 +98975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -98390,13 +98990,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -98422,7 +99022,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -98481,7 +99081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -98580,7 +99180,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -98611,8 +99211,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -98638,7 +99238,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -98681,7 +99285,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -98728,8 +99336,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -98983,8 +99591,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -99150,7 +99758,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -99430,7 +100038,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -99451,15 +100059,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -99675,8 +100283,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -99690,13 +100298,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -99722,7 +100330,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -99781,7 +100389,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -99880,7 +100488,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -99911,8 +100519,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -99938,7 +100546,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -99981,7 +100593,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -100028,8 +100644,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -100283,8 +100899,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -100450,7 +101066,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -100730,7 +101346,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -100751,15 +101367,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -100975,8 +101591,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -100990,13 +101606,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -101022,7 +101638,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -101081,7 +101697,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -101180,7 +101796,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -101211,8 +101827,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -101238,7 +101854,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -101281,7 +101901,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -101328,8 +101952,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -101583,8 +102207,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -101750,7 +102374,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -102030,7 +102654,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -102051,15 +102675,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -102275,8 +102899,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -102290,13 +102914,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -102322,7 +102946,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -102381,7 +103005,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -102480,7 +103104,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -102511,8 +103135,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -102538,7 +103162,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -102581,7 +103209,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -102628,8 +103260,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -102883,8 +103515,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -103050,7 +103682,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -103330,7 +103962,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -103351,15 +103983,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -103575,8 +104207,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -103590,13 +104222,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -103622,7 +104254,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -103681,7 +104313,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -103780,7 +104412,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -103811,8 +104443,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -103838,7 +104470,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -103881,7 +104517,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -103928,8 +104568,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -104183,8 +104823,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -104350,7 +104990,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -104630,7 +105270,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -104651,15 +105291,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -104875,8 +105515,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -104890,13 +105530,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -104922,7 +105562,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -104981,7 +105621,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -105080,7 +105720,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -105111,8 +105751,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -105138,7 +105778,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -105181,7 +105825,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -105228,8 +105876,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -105483,8 +106131,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -105650,7 +106298,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -105930,7 +106578,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -105951,15 +106599,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -106175,8 +106823,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -106190,13 +106838,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -106222,7 +106870,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -106281,7 +106929,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -106380,7 +107028,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -106411,8 +107059,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -106438,7 +107086,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -106481,7 +107133,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -106528,8 +107184,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -106783,8 +107439,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -106950,7 +107606,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -107230,7 +107886,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -107251,15 +107907,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -107475,8 +108131,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -107490,13 +108146,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -107522,7 +108178,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -107581,7 +108237,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -107680,7 +108336,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -107711,8 +108367,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -107738,7 +108394,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -107781,7 +108441,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -107828,8 +108492,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -108083,8 +108747,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -108250,7 +108914,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -108530,7 +109194,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -108551,15 +109215,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -108775,8 +109439,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -108790,13 +109454,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -108822,7 +109486,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -108881,7 +109545,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -108980,7 +109644,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -109011,8 +109675,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -109038,7 +109702,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -109081,7 +109749,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -109128,8 +109800,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -109383,8 +110055,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -109550,7 +110222,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -109830,7 +110502,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -109851,15 +110523,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -110075,8 +110747,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -110090,13 +110762,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -110122,7 +110794,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -110181,7 +110853,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -110280,7 +110952,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -110311,8 +110983,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -110338,7 +111010,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -110381,7 +111057,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -110428,8 +111108,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -110683,8 +111363,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -110850,7 +111530,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -111130,7 +111810,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -111151,15 +111831,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -111375,8 +112055,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -111390,13 +112070,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -111422,7 +112102,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -111481,7 +112161,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -111580,7 +112260,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -111611,8 +112291,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -111638,7 +112318,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -111681,7 +112365,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -111728,8 +112416,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -111983,8 +112671,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -112150,7 +112838,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -112430,7 +113118,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -112451,15 +113139,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -112675,8 +113363,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -112690,13 +113378,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -112722,7 +113410,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -112781,7 +113469,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -112880,7 +113568,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -112911,8 +113599,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -112938,7 +113626,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -112981,7 +113673,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -113028,8 +113724,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -113283,8 +113979,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -113450,7 +114146,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -113730,7 +114426,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -113751,15 +114447,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -113975,8 +114671,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -113990,13 +114686,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -114022,7 +114718,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -114081,7 +114777,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -114180,7 +114876,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -114211,8 +114907,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -114238,7 +114934,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -114281,7 +114981,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -114328,8 +115032,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -114583,8 +115287,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -114750,7 +115454,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -115030,7 +115734,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -115051,15 +115755,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -115275,8 +115979,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -115290,13 +115994,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -115322,7 +116026,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -115381,7 +116085,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -115480,7 +116184,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -115511,8 +116215,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -115538,7 +116242,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -115581,7 +116289,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -115628,8 +116340,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -115883,8 +116595,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -116050,7 +116762,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -116330,7 +117042,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -116351,15 +117063,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -116575,8 +117287,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -116590,13 +117302,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -116622,7 +117334,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -116681,7 +117393,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -116780,7 +117492,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -116811,8 +117523,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -116838,7 +117550,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -116881,7 +117597,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -116928,8 +117648,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -117183,8 +117903,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -117350,7 +118070,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -117630,7 +118350,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -117651,15 +118371,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -117875,8 +118595,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -117890,13 +118610,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -117922,7 +118642,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -117981,7 +118701,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -118080,7 +118800,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -118111,8 +118831,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -118138,7 +118858,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -118181,7 +118905,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -118228,8 +118956,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -118483,8 +119211,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -118650,7 +119378,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -118930,7 +119658,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -118951,15 +119679,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -119175,8 +119903,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -119190,13 +119918,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -119222,7 +119950,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -119281,7 +120009,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -119380,7 +120108,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -119411,8 +120139,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -119438,7 +120166,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -119481,7 +120213,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -119528,8 +120264,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -119783,8 +120519,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -119950,7 +120686,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -120230,7 +120966,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -120251,15 +120987,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -120475,8 +121211,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -120490,13 +121226,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -120522,7 +121258,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -120581,7 +121317,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -120680,7 +121416,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -120711,8 +121447,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -120738,7 +121474,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -120781,7 +121521,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -120828,8 +121572,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -121083,8 +121827,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -121250,7 +121994,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -121530,7 +122274,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -121551,15 +122295,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -121775,8 +122519,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -121790,13 +122534,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -121822,7 +122566,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -121881,7 +122625,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -121980,7 +122724,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -122011,8 +122755,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -122038,7 +122782,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -122081,7 +122829,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -122128,8 +122880,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -122383,8 +123135,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -122550,7 +123302,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -122830,7 +123582,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -122851,15 +123603,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -123075,8 +123827,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -123090,13 +123842,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -123122,7 +123874,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -123181,7 +123933,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -123280,7 +124032,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -123311,8 +124063,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -123338,7 +124090,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -123381,7 +124137,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -123428,8 +124188,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -123683,8 +124443,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -123850,7 +124610,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -124130,7 +124890,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -124151,15 +124911,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -124375,8 +125135,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -124390,13 +125150,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -124422,7 +125182,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -124481,7 +125241,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -124580,7 +125340,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -124611,8 +125371,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -124638,7 +125398,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -124681,7 +125445,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -124728,8 +125496,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -124983,8 +125751,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -125150,7 +125918,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -125430,7 +126198,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -125451,15 +126219,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -125675,8 +126443,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -125690,13 +126458,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -125722,7 +126490,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -125781,7 +126549,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -125880,7 +126648,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -125911,8 +126679,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -125938,7 +126706,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -125981,7 +126753,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -126028,8 +126804,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -126283,8 +127059,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -126450,7 +127226,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -126730,7 +127506,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -126751,15 +127527,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -126975,8 +127751,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -126990,13 +127766,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -127022,7 +127798,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -127081,7 +127857,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -127180,7 +127956,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -127211,8 +127987,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -127238,7 +128014,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -127281,7 +128061,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -127328,8 +128112,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -127583,8 +128367,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -127750,7 +128534,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -128030,7 +128814,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -128051,15 +128835,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -128275,8 +129059,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -128290,13 +129074,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -128322,7 +129106,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -128381,7 +129165,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -128480,7 +129264,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -128511,8 +129295,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -128538,7 +129322,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -128581,7 +129369,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -128628,8 +129420,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -128883,8 +129675,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -129050,7 +129842,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -129330,7 +130122,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -129351,15 +130143,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -129575,8 +130367,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -129590,13 +130382,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -129622,7 +130414,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -129681,7 +130473,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -129780,7 +130572,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -129811,8 +130603,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -129838,7 +130630,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -129881,7 +130677,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -129928,8 +130728,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -130183,8 +130983,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -130350,7 +131150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -130630,7 +131430,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -130651,15 +131451,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -130875,8 +131675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -130890,13 +131690,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -130922,7 +131722,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -130981,7 +131781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -131080,7 +131880,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -131111,8 +131911,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -131138,7 +131938,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -131181,7 +131985,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -131228,8 +132036,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -131483,8 +132291,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -131650,7 +132458,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -131930,7 +132738,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -131951,15 +132759,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -132175,8 +132983,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -132190,13 +132998,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -132222,7 +133030,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -132281,7 +133089,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -132380,7 +133188,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -132411,8 +133219,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -132438,7 +133246,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -132481,7 +133293,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -132528,8 +133344,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -132783,8 +133599,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -132950,7 +133766,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -133230,7 +134046,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -133251,15 +134067,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -133475,8 +134291,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -133490,13 +134306,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -133522,7 +134338,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -133581,7 +134397,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -133680,7 +134496,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -133711,8 +134527,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -133738,7 +134554,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -133781,7 +134601,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -133828,8 +134652,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -134083,8 +134907,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -134250,7 +135074,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -134530,7 +135354,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -134551,15 +135375,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -134775,8 +135599,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -134790,13 +135614,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -134822,7 +135646,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -134881,7 +135705,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -134980,7 +135804,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -135011,8 +135835,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -135038,7 +135862,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -135081,7 +135909,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -135128,8 +135960,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -135383,8 +136215,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -135550,7 +136382,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -135830,7 +136662,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -135851,15 +136683,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -136075,8 +136907,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -136090,13 +136922,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -136122,7 +136954,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -136181,7 +137013,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -136280,7 +137112,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -136311,8 +137143,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -136338,7 +137170,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -136381,7 +137217,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -136428,8 +137268,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -136683,8 +137523,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -136850,7 +137690,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -137130,7 +137970,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -137151,15 +137991,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -137375,8 +138215,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -137390,13 +138230,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -137422,7 +138262,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -137481,7 +138321,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -137580,7 +138420,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -137611,8 +138451,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -137638,7 +138478,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -137681,7 +138525,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -137728,8 +138576,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -137983,8 +138831,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -138150,7 +138998,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -138430,7 +139278,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -138451,15 +139299,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -138675,8 +139523,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -138690,13 +139538,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -138722,7 +139570,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -138781,7 +139629,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -138880,7 +139728,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -138911,8 +139759,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -138938,7 +139786,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -138981,7 +139833,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -139028,8 +139884,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -139283,8 +140139,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -139450,7 +140306,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -139730,7 +140586,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -139751,15 +140607,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -139975,8 +140831,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -139990,13 +140846,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -140022,7 +140878,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -140081,7 +140937,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -140180,7 +141036,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -140211,8 +141067,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -140238,7 +141094,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -140281,7 +141141,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -140328,8 +141192,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -140583,8 +141447,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -140750,7 +141614,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -141030,7 +141894,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -141051,15 +141915,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -141275,8 +142139,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -141290,13 +142154,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -141322,7 +142186,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -141381,7 +142245,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -141480,7 +142344,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -141511,8 +142375,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -141538,7 +142402,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -141581,7 +142449,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -141628,8 +142500,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -141883,8 +142755,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -142050,7 +142922,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -142330,7 +143202,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -142351,15 +143223,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -142575,8 +143447,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -142590,13 +143462,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -142622,7 +143494,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -142681,7 +143553,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -142780,7 +143652,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -142811,8 +143683,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -142838,7 +143710,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -142881,7 +143757,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -142928,8 +143808,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -143183,8 +144063,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -143350,7 +144230,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -143630,7 +144510,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -143651,15 +144531,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -143875,8 +144755,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -143890,13 +144770,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -143922,7 +144802,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -143981,7 +144861,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -144080,7 +144960,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -144111,8 +144991,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -144138,7 +145018,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -144181,7 +145065,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -144228,8 +145116,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -144483,8 +145371,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -144650,7 +145538,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -144930,7 +145818,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -144951,15 +145839,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -145175,8 +146063,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -145190,13 +146078,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -145222,7 +146110,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -145281,7 +146169,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -145380,7 +146268,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -145411,8 +146299,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -145438,7 +146326,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -145481,7 +146373,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -145528,8 +146424,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -145783,8 +146679,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -145950,7 +146846,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -146230,7 +147126,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -146251,15 +147147,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -146475,8 +147371,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -146490,13 +147386,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -146522,7 +147418,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -146581,7 +147477,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -146680,7 +147576,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -146711,8 +147607,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -146738,7 +147634,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -146781,7 +147681,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -146828,8 +147732,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -147083,8 +147987,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -147250,7 +148154,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -147530,7 +148434,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -147551,15 +148455,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -147775,8 +148679,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -147790,13 +148694,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -147822,7 +148726,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -147881,7 +148785,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -147980,7 +148884,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -148011,8 +148915,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -148038,7 +148942,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -148081,7 +148989,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -148128,8 +149040,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -148383,8 +149295,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -148550,7 +149462,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -148830,7 +149742,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -148851,15 +149763,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -149075,8 +149987,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -149090,13 +150002,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -149122,7 +150034,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -149181,7 +150093,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -149280,7 +150192,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -149311,8 +150223,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -149338,7 +150250,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -149381,7 +150297,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -149428,8 +150348,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -149683,8 +150603,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -149850,7 +150770,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -150130,7 +151050,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -150151,15 +151071,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -150375,8 +151295,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -150390,13 +151310,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -150422,7 +151342,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -150481,7 +151401,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -150580,7 +151500,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -150611,8 +151531,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -150638,7 +151558,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -150681,7 +151605,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -150728,8 +151656,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -150983,8 +151911,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -151150,7 +152078,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -151430,7 +152358,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -151451,15 +152379,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -151675,8 +152603,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -151690,13 +152618,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -151722,7 +152650,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -151781,7 +152709,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -151880,7 +152808,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -151911,8 +152839,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -151938,7 +152866,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -151981,7 +152913,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -152028,8 +152964,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -152283,8 +153219,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -152450,7 +153386,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -152730,7 +153666,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -152751,15 +153687,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -152975,8 +153911,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -152990,13 +153926,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -153022,7 +153958,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -153081,7 +154017,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -153180,7 +154116,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -153211,8 +154147,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -153238,7 +154174,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -153281,7 +154221,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -153328,8 +154272,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -153583,8 +154527,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -153750,7 +154694,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -154030,7 +154974,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -154051,15 +154995,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -154275,8 +155219,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -154290,13 +155234,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -154322,7 +155266,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -154381,7 +155325,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -154480,7 +155424,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -154511,8 +155455,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -154538,7 +155482,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -154581,7 +155529,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -154628,8 +155580,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -154883,8 +155835,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -155050,7 +156002,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -155330,7 +156282,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -155351,15 +156303,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -155575,8 +156527,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -155590,13 +156542,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -155622,7 +156574,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -155681,7 +156633,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -155780,7 +156732,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -155811,8 +156763,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -155838,7 +156790,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -155881,7 +156837,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -155928,8 +156888,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -156183,8 +157143,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -156350,7 +157310,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -156630,7 +157590,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -156651,15 +157611,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -156875,8 +157835,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -156890,13 +157850,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -156922,7 +157882,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -156981,7 +157941,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -157080,7 +158040,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -157111,8 +158071,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -157138,7 +158098,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -157181,7 +158145,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -157228,8 +158196,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -157483,8 +158451,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -157650,7 +158618,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -157930,7 +158898,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -157951,15 +158919,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -158175,8 +159143,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -158190,13 +159158,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -158222,7 +159190,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -158281,7 +159249,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -158380,7 +159348,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -158411,8 +159379,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -158438,7 +159406,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -158481,7 +159453,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -158528,8 +159504,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -158783,8 +159759,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -158950,7 +159926,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -159230,7 +160206,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -159251,15 +160227,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -159475,8 +160451,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -159490,13 +160466,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -159522,7 +160498,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -159581,7 +160557,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -159680,7 +160656,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -159711,8 +160687,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -159738,7 +160714,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -159781,7 +160761,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -159828,8 +160812,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -160083,8 +161067,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -160250,7 +161234,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -160530,7 +161514,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -160551,15 +161535,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -160775,8 +161759,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -160790,13 +161774,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -160822,7 +161806,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -160881,7 +161865,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -160980,7 +161964,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -161011,8 +161995,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -161038,7 +162022,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -161081,7 +162069,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -161128,8 +162120,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -161383,8 +162375,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -161550,7 +162542,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -161830,7 +162822,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -161851,15 +162843,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -162075,8 +163067,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -162090,13 +163082,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -162122,7 +163114,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -162181,7 +163173,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -162280,7 +163272,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -162311,8 +163303,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -162338,7 +163330,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -162381,7 +163377,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -162428,8 +163428,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -162683,8 +163683,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -162850,7 +163850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -163130,7 +164130,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -163151,15 +164151,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -163375,8 +164375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -163390,13 +164390,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -163422,7 +164422,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -163481,7 +164481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -163580,7 +164580,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -163611,8 +164611,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -163638,7 +164638,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -163681,7 +164685,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -163728,8 +164736,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -163983,8 +164991,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -164150,7 +165158,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -164430,7 +165438,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -164451,15 +165459,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -164675,8 +165683,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -164690,13 +165698,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -164722,7 +165730,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -164781,7 +165789,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -164880,7 +165888,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -164911,8 +165919,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -164938,7 +165946,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -164981,7 +165993,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -165028,8 +166044,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -165283,8 +166299,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -165450,7 +166466,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -165730,7 +166746,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -165751,15 +166767,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -165975,8 +166991,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -165990,13 +167006,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -166022,7 +167038,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -166081,7 +167097,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -166180,7 +167196,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -166211,8 +167227,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -166238,7 +167254,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -166281,7 +167301,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -166328,8 +167352,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -166583,8 +167607,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -166750,7 +167774,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -167030,7 +168054,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -167051,15 +168075,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -167275,8 +168299,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -167290,13 +168314,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -167322,7 +168346,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -167381,7 +168405,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -167480,7 +168504,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -167511,8 +168535,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -167538,7 +168562,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -167581,7 +168609,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -167628,8 +168660,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -167883,8 +168915,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -168050,7 +169082,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -168330,7 +169362,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -168351,15 +169383,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -168575,8 +169607,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -168590,13 +169622,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -168622,7 +169654,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -168681,7 +169713,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -168780,7 +169812,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -168811,8 +169843,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -168838,7 +169870,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -168881,7 +169917,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -168928,8 +169968,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -169183,8 +170223,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -169350,7 +170390,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -169630,7 +170670,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -169651,15 +170691,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -169875,8 +170915,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -169890,13 +170930,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -169922,7 +170962,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -169981,7 +171021,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -170080,7 +171120,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -170111,8 +171151,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -170138,7 +171178,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -170181,7 +171225,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -170228,8 +171276,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -170483,8 +171531,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -170650,7 +171698,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -170930,7 +171978,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -170951,15 +171999,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -171175,8 +172223,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -171190,13 +172238,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -171222,7 +172270,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -171281,7 +172329,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -171380,7 +172428,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -171411,8 +172459,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -171438,7 +172486,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -171481,7 +172533,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -171528,8 +172584,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -171783,8 +172839,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -171950,7 +173006,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -172230,7 +173286,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -172251,15 +173307,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -172475,8 +173531,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -172490,13 +173546,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -172522,7 +173578,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -172581,7 +173637,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -172680,7 +173736,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -172711,8 +173767,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -172738,7 +173794,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -172781,7 +173841,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -172828,8 +173892,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -173083,8 +174147,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -173250,7 +174314,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -173530,7 +174594,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -173551,15 +174615,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -173775,8 +174839,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -173790,13 +174854,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -173822,7 +174886,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -173881,7 +174945,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -173980,7 +175044,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -174011,8 +175075,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -174038,7 +175102,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -174081,7 +175149,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -174128,8 +175200,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -174383,8 +175455,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -174550,7 +175622,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -174830,7 +175902,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -174851,15 +175923,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -175075,8 +176147,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -175090,13 +176162,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -175122,7 +176194,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -175181,7 +176253,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -175280,7 +176352,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -175311,8 +176383,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -175338,7 +176410,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -175381,7 +176457,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -175428,8 +176508,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -175683,8 +176763,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -175850,7 +176930,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -176130,7 +177210,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -176151,15 +177231,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -176375,8 +177455,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -176390,13 +177470,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -176422,7 +177502,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -176481,7 +177561,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -176580,7 +177660,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -176611,8 +177691,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -176638,7 +177718,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -176681,7 +177765,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -176728,8 +177816,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -176983,8 +178071,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -177150,7 +178238,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -177430,7 +178518,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -177451,15 +178539,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -177675,8 +178763,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -177690,13 +178778,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -177722,7 +178810,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -177781,7 +178869,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -177880,7 +178968,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -177911,8 +178999,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -177938,7 +179026,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -177981,7 +179073,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -178028,8 +179124,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -178283,8 +179379,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -178450,7 +179546,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -178730,7 +179826,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -178751,15 +179847,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -178975,8 +180071,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -178990,13 +180086,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -179022,7 +180118,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -179081,7 +180177,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -179180,7 +180276,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -179211,8 +180307,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -179238,7 +180334,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -179281,7 +180381,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -179328,8 +180432,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -179583,8 +180687,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -179750,7 +180854,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -180030,7 +181134,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -180051,15 +181155,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -180275,8 +181379,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -180290,13 +181394,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -180322,7 +181426,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -180381,7 +181485,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -180480,7 +181584,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -180511,8 +181615,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -180538,7 +181642,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -180581,7 +181689,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -180628,8 +181740,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -180883,8 +181995,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -181050,7 +182162,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -181330,7 +182442,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -181351,15 +182463,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -181575,8 +182687,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -181590,13 +182702,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -181622,7 +182734,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -181681,7 +182793,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -181780,7 +182892,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -181811,8 +182923,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -181838,7 +182950,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -181881,7 +182997,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -181928,8 +183048,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -182183,8 +183303,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -182350,7 +183470,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -182630,7 +183750,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -182651,15 +183771,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -182875,8 +183995,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -182890,13 +184010,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -182922,7 +184042,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -182981,7 +184101,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -183080,7 +184200,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -183111,8 +184231,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -183138,7 +184258,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -183181,7 +184305,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -183228,8 +184356,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -183483,8 +184611,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -183650,7 +184778,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -183930,7 +185058,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -183951,15 +185079,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -184175,8 +185303,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -184190,13 +185318,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -184222,7 +185350,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -184281,7 +185409,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -184380,7 +185508,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -184411,8 +185539,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -184438,7 +185566,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -184481,7 +185613,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -184528,8 +185664,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -184783,8 +185919,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -184950,7 +186086,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -185230,7 +186366,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -185251,15 +186387,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -185475,8 +186611,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -185490,13 +186626,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -185522,7 +186658,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -185581,7 +186717,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -185680,7 +186816,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -185711,8 +186847,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -185738,7 +186874,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -185781,7 +186921,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -185828,8 +186972,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -186083,8 +187227,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -186250,7 +187394,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -186530,7 +187674,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -186551,15 +187695,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -186775,8 +187919,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -186790,13 +187934,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -186822,7 +187966,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -186881,7 +188025,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -186980,7 +188124,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -187011,8 +188155,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -187038,7 +188182,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -187081,7 +188229,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -187128,8 +188280,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -187383,8 +188535,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -187550,7 +188702,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -187830,7 +188982,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -187851,15 +189003,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -188075,8 +189227,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -188090,13 +189242,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -188122,7 +189274,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -188181,7 +189333,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -188280,7 +189432,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -188311,8 +189463,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -188338,7 +189490,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -188381,7 +189537,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -188428,8 +189588,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -188683,8 +189843,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -188850,7 +190010,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -189130,7 +190290,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -189151,15 +190311,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -189375,8 +190535,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -189390,13 +190550,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -189422,7 +190582,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -189481,7 +190641,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -189580,7 +190740,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -189611,8 +190771,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -189638,7 +190798,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -189681,7 +190845,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -189728,8 +190896,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -189983,8 +191151,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -190150,7 +191318,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -190430,7 +191598,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -190451,15 +191619,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -190675,8 +191843,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -190690,13 +191858,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -190722,7 +191890,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -190781,7 +191949,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -190880,7 +192048,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -190911,8 +192079,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -190938,7 +192106,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -190981,7 +192153,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -191028,8 +192204,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -191283,8 +192459,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -191450,7 +192626,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -191730,7 +192906,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -191751,15 +192927,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -191975,8 +193151,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -191990,13 +193166,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -192022,7 +193198,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -192081,7 +193257,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -192180,7 +193356,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -192211,8 +193387,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -192238,7 +193414,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -192281,7 +193461,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -192328,8 +193512,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -192583,8 +193767,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -192750,7 +193934,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -193030,7 +194214,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -193051,15 +194235,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -193275,8 +194459,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -193290,13 +194474,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -193322,7 +194506,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -193381,7 +194565,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -193480,7 +194664,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -193511,8 +194695,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -193538,7 +194722,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -193581,7 +194769,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -193628,8 +194820,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -193883,8 +195075,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -194050,7 +195242,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -194330,7 +195522,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -194351,15 +195543,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -194575,8 +195767,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -194590,13 +195782,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -194622,7 +195814,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -194681,7 +195873,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -194780,7 +195972,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -194811,8 +196003,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -194838,7 +196030,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -194881,7 +196077,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -194928,8 +196128,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -195183,8 +196383,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -195350,7 +196550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -195630,7 +196830,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -195651,15 +196851,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -195875,8 +197075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -195890,13 +197090,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -195922,7 +197122,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -195981,7 +197181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -196080,7 +197280,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -196111,8 +197311,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -196138,7 +197338,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -196181,7 +197385,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -196228,8 +197436,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -196483,8 +197691,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -196650,7 +197858,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -196930,7 +198138,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -196951,15 +198159,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -197175,8 +198383,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -197190,13 +198398,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -197222,7 +198430,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -197281,7 +198489,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -197380,7 +198588,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -197411,8 +198619,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -197438,7 +198646,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -197481,7 +198693,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -197528,8 +198744,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -197783,8 +198999,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -197950,7 +199166,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -198230,7 +199446,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -198251,15 +199467,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -198475,8 +199691,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -198490,13 +199706,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -198522,7 +199738,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -198581,7 +199797,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -198680,7 +199896,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -198711,8 +199927,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -198738,7 +199954,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -198781,7 +200001,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -198828,8 +200052,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -199083,8 +200307,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -199250,7 +200474,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -199530,7 +200754,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -199551,15 +200775,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -199775,8 +200999,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -199790,13 +201014,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -199822,7 +201046,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -199881,7 +201105,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -199980,7 +201204,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -200011,8 +201235,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -200038,7 +201262,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -200081,7 +201309,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -200128,8 +201360,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -200383,8 +201615,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -200550,7 +201782,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -200830,7 +202062,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -200851,15 +202083,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -201075,8 +202307,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -201090,13 +202322,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -201122,7 +202354,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -201181,7 +202413,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -201280,7 +202512,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -201311,8 +202543,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -201338,7 +202570,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -201381,7 +202617,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -201428,8 +202668,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -201683,8 +202923,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -201850,7 +203090,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -202130,7 +203370,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -202151,15 +203391,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -202375,8 +203615,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -202390,13 +203630,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -202422,7 +203662,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -202481,7 +203721,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -202580,7 +203820,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -202611,8 +203851,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -202638,7 +203878,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -202681,7 +203925,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -202728,8 +203976,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -202983,8 +204231,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -203150,7 +204398,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -203430,7 +204678,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -203451,15 +204699,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -203675,8 +204923,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -203690,13 +204938,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -203722,7 +204970,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -203781,7 +205029,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -203880,7 +205128,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -203911,8 +205159,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -203938,7 +205186,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -203981,7 +205233,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -204028,8 +205284,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -204283,8 +205539,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -204450,7 +205706,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -204730,7 +205986,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -204751,15 +206007,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -204975,8 +206231,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -204990,13 +206246,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -205022,7 +206278,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -205081,7 +206337,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -205180,7 +206436,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -205211,8 +206467,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -205238,7 +206494,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -205281,7 +206541,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -205328,8 +206592,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -205583,8 +206847,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -205750,7 +207014,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -206030,7 +207294,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -206051,15 +207315,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -206275,8 +207539,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -206290,13 +207554,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -206322,7 +207586,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -206381,7 +207645,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -206480,7 +207744,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -206511,8 +207775,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -206538,7 +207802,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -206581,7 +207849,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -206628,8 +207900,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -206883,8 +208155,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -207050,7 +208322,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -207330,7 +208602,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -207351,15 +208623,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -207575,8 +208847,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -207590,13 +208862,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -207622,7 +208894,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -207681,7 +208953,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -207780,7 +209052,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -207811,8 +209083,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -207838,7 +209110,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -207881,7 +209157,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -207928,8 +209208,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -208183,8 +209463,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -208350,7 +209630,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -208630,7 +209910,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -208651,15 +209931,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -208875,8 +210155,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -208890,13 +210170,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -208922,7 +210202,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -208981,7 +210261,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -209080,7 +210360,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -209111,8 +210391,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -209138,7 +210418,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -209181,7 +210465,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -209228,8 +210516,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -209483,8 +210771,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -209650,7 +210938,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -209930,7 +211218,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -209951,15 +211239,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -210175,8 +211463,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -210190,13 +211478,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -210222,7 +211510,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -210281,7 +211569,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -210380,7 +211668,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -210411,8 +211699,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -210438,7 +211726,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -210481,7 +211773,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -210528,8 +211824,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -210783,8 +212079,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -210950,7 +212246,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -211230,7 +212526,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -211251,15 +212547,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -211475,8 +212771,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -211490,13 +212786,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -211522,7 +212818,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -211581,7 +212877,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -211680,7 +212976,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -211711,8 +213007,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -211738,7 +213034,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -211781,7 +213081,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -211828,8 +213132,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -212083,8 +213387,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -212250,7 +213554,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -212530,7 +213834,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -212551,15 +213855,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -212775,8 +214079,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -212790,13 +214094,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -212822,7 +214126,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -212881,7 +214185,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -212980,7 +214284,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -213011,8 +214315,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -213038,7 +214342,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -213081,7 +214389,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -213128,8 +214440,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -213383,8 +214695,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -213550,7 +214862,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -213830,7 +215142,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -213851,15 +215163,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -214075,8 +215387,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -214090,13 +215402,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -214122,7 +215434,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -214181,7 +215493,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -214280,7 +215592,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -214311,8 +215623,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -214338,7 +215650,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -214381,7 +215697,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -214428,8 +215748,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -214683,8 +216003,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -214850,7 +216170,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -215130,7 +216450,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -215151,15 +216471,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -215375,8 +216695,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -215390,13 +216710,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -215422,7 +216742,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -215481,7 +216801,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -215580,7 +216900,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -215611,8 +216931,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -215638,7 +216958,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -215681,7 +217005,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -215728,8 +217056,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -215983,8 +217311,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -216150,7 +217478,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -216430,7 +217758,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -216451,15 +217779,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -216675,8 +218003,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -216690,13 +218018,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -216722,7 +218050,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -216781,7 +218109,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -216880,7 +218208,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -216911,8 +218239,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -216938,7 +218266,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -216981,7 +218313,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -217028,8 +218364,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -217283,8 +218619,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -217450,7 +218786,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -217730,7 +219066,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -217751,15 +219087,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -217975,8 +219311,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -217990,13 +219326,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -218022,7 +219358,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -218081,7 +219417,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -218180,7 +219516,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -218211,8 +219547,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -218238,7 +219574,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -218281,7 +219621,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -218328,8 +219672,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -218583,8 +219927,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -218750,7 +220094,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -219030,7 +220374,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -219051,15 +220395,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -219275,8 +220619,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -219290,13 +220634,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -219322,7 +220666,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -219381,7 +220725,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -219480,7 +220824,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -219511,8 +220855,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -219538,7 +220882,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -219581,7 +220929,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -219628,8 +220980,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -219883,8 +221235,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -220050,7 +221402,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -220330,7 +221682,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -220351,15 +221703,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -220575,8 +221927,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -220590,13 +221942,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -220622,7 +221974,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -220681,7 +222033,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -220780,7 +222132,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -220811,8 +222163,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -220838,7 +222190,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -220881,7 +222237,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -220928,8 +222288,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -221183,8 +222543,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -221350,7 +222710,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -221630,7 +222990,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -221651,15 +223011,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -221875,8 +223235,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -221890,13 +223250,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -221922,7 +223282,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -221981,7 +223341,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -222080,7 +223440,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -222111,8 +223471,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -222138,7 +223498,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -222181,7 +223545,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -222228,8 +223596,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -222483,8 +223851,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -222650,7 +224018,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -222930,7 +224298,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -222951,15 +224319,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -223175,8 +224543,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -223190,13 +224558,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -223222,7 +224590,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -223281,7 +224649,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -223380,7 +224748,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -223411,8 +224779,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -223438,7 +224806,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -223481,7 +224853,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -223528,8 +224904,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -223783,8 +225159,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -223950,7 +225326,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -224230,7 +225606,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -224251,15 +225627,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -224475,8 +225851,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -224490,13 +225866,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -224522,7 +225898,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -224581,7 +225957,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -224680,7 +226056,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -224711,8 +226087,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -224738,7 +226114,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -224781,7 +226161,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -224828,8 +226212,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -225083,8 +226467,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -225250,7 +226634,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -225530,7 +226914,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -225551,15 +226935,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -225775,8 +227159,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -225790,13 +227174,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -225822,7 +227206,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -225881,7 +227265,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -225980,7 +227364,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -226011,8 +227395,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -226038,7 +227422,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -226081,7 +227469,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -226128,8 +227520,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -226383,8 +227775,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -226550,7 +227942,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -226830,7 +228222,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -226851,15 +228243,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -227075,8 +228467,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -227090,13 +228482,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -227122,7 +228514,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -227181,7 +228573,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -227280,7 +228672,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -227311,8 +228703,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -227338,7 +228730,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -227381,7 +228777,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -227428,8 +228828,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -227683,8 +229083,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -227850,7 +229250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -228130,7 +229530,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -228151,15 +229551,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -228375,8 +229775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -228390,13 +229790,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -228422,7 +229822,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -228481,7 +229881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -228580,7 +229980,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -228611,8 +230011,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -228638,7 +230038,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -228681,7 +230085,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -228728,8 +230136,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -228983,8 +230391,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -229150,7 +230558,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -229430,7 +230838,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -229451,15 +230859,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -229675,8 +231083,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -229690,13 +231098,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -229722,7 +231130,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -229781,7 +231189,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -229880,7 +231288,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -229911,8 +231319,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -229938,7 +231346,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -229981,7 +231393,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -230028,8 +231444,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -230283,8 +231699,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -230450,7 +231866,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -230730,7 +232146,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -230751,15 +232167,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -230975,8 +232391,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -230990,13 +232406,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -231022,7 +232438,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -231081,7 +232497,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -231180,7 +232596,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -231211,8 +232627,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -231238,7 +232654,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -231281,7 +232701,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -231328,8 +232752,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -231583,8 +233007,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -231750,7 +233174,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -232030,7 +233454,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -232051,15 +233475,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -232275,8 +233699,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -232290,13 +233714,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -232322,7 +233746,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -232381,7 +233805,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -232480,7 +233904,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -232511,8 +233935,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -232538,7 +233962,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -232581,7 +234009,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -232628,8 +234060,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -232883,8 +234315,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -233050,7 +234482,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -233330,7 +234762,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -233351,15 +234783,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -233575,8 +235007,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -233590,13 +235022,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -233622,7 +235054,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -233681,7 +235113,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -233780,7 +235212,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -233811,8 +235243,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -233838,7 +235270,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -233881,7 +235317,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -233928,8 +235368,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -234183,8 +235623,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -234350,7 +235790,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -234630,7 +236070,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -234651,15 +236091,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -234875,8 +236315,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -234890,13 +236330,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -234922,7 +236362,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -234981,7 +236421,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -235080,7 +236520,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -235111,8 +236551,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -235138,7 +236578,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -235181,7 +236625,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -235228,8 +236676,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -235483,8 +236931,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -235650,7 +237098,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -235930,7 +237378,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -235951,15 +237399,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -236175,8 +237623,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -236190,13 +237638,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -236222,7 +237670,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -236281,7 +237729,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -236380,7 +237828,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -236411,8 +237859,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -236438,7 +237886,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -236481,7 +237933,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -236528,8 +237984,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -236783,8 +238239,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -236950,7 +238406,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -237230,7 +238686,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -237251,15 +238707,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -237475,8 +238931,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -237490,13 +238946,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -237522,7 +238978,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -237581,7 +239037,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -237680,7 +239136,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -237711,8 +239167,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -237738,7 +239194,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -237781,7 +239241,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -237828,8 +239292,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -238083,8 +239547,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -238250,7 +239714,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -238530,7 +239994,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -238551,15 +240015,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -238775,8 +240239,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -238790,13 +240254,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -238822,7 +240286,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -238881,7 +240345,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -238980,7 +240444,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -239011,8 +240475,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -239038,7 +240502,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -239081,7 +240549,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -239128,8 +240600,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -239383,8 +240855,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -239550,7 +241022,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -239830,7 +241302,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -239851,15 +241323,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -240075,8 +241547,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -240090,13 +241562,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -240122,7 +241594,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -240181,7 +241653,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -240280,7 +241752,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -240311,8 +241783,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -240338,7 +241810,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -240381,7 +241857,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -240428,8 +241908,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -240683,8 +242163,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -240850,7 +242330,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -241130,7 +242610,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -241151,15 +242631,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -241375,8 +242855,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -241390,13 +242870,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -241422,7 +242902,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -241481,7 +242961,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -241580,7 +243060,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -241611,8 +243091,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -241638,7 +243118,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -241681,7 +243165,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -241728,8 +243216,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -241983,8 +243471,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -242150,7 +243638,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -242430,7 +243918,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -242451,15 +243939,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -242675,8 +244163,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -242690,13 +244178,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -242722,7 +244210,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -242781,7 +244269,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -242880,7 +244368,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -242911,8 +244399,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -242938,7 +244426,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -242981,7 +244473,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -243028,8 +244524,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -243283,8 +244779,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -243450,7 +244946,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -243730,7 +245226,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -243751,15 +245247,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -243975,8 +245471,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -243990,13 +245486,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -244022,7 +245518,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -244081,7 +245577,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -244180,7 +245676,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -244211,8 +245707,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -244238,7 +245734,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -244281,7 +245781,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -244328,8 +245832,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -244583,8 +246087,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -244750,7 +246254,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -245030,7 +246534,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -245051,15 +246555,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -245275,8 +246779,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -245290,13 +246794,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -245322,7 +246826,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -245381,7 +246885,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -245480,7 +246984,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -245511,8 +247015,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -245538,7 +247042,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -245581,7 +247089,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -245628,8 +247140,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -245883,8 +247395,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -246050,7 +247562,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -246330,7 +247842,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -246351,15 +247863,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -246575,8 +248087,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -246590,13 +248102,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -246622,7 +248134,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -246681,7 +248193,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -246780,7 +248292,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -246811,8 +248323,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -246838,7 +248350,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -246881,7 +248397,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -246928,8 +248448,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -247183,8 +248703,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -247350,7 +248870,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -247630,7 +249150,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -247651,15 +249171,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -247875,8 +249395,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -247890,13 +249410,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -247922,7 +249442,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -247981,7 +249501,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -248080,7 +249600,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -248111,8 +249631,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -248138,7 +249658,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -248181,7 +249705,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -248228,8 +249756,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -248483,8 +250011,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -248650,7 +250178,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -248930,7 +250458,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -248951,15 +250479,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -249175,8 +250703,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -249190,13 +250718,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -249222,7 +250750,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -249281,7 +250809,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -249380,7 +250908,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -249411,8 +250939,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -249438,7 +250966,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -249481,7 +251013,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -249528,8 +251064,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -249783,8 +251319,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -249950,7 +251486,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -250230,7 +251766,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -250251,15 +251787,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -250475,8 +252011,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -250490,13 +252026,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -250522,7 +252058,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -250581,7 +252117,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -250680,7 +252216,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -250711,8 +252247,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -250738,7 +252274,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -250781,7 +252321,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -250828,8 +252372,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -251083,8 +252627,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -251250,7 +252794,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -251530,7 +253074,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -251551,15 +253095,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -251775,8 +253319,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -251790,13 +253334,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -251822,7 +253366,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -251881,7 +253425,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -251980,7 +253524,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -252011,8 +253555,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -252038,7 +253582,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -252081,7 +253629,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -252128,8 +253680,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -252383,8 +253935,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -252550,7 +254102,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -252830,7 +254382,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -252851,15 +254403,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -253075,8 +254627,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -253090,13 +254642,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -253122,7 +254674,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -253181,7 +254733,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -253280,7 +254832,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -253311,8 +254863,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -253338,7 +254890,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -253381,7 +254937,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -253428,8 +254988,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -253683,8 +255243,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -253850,7 +255410,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -254130,7 +255690,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -254151,15 +255711,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -254375,8 +255935,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -254390,13 +255950,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -254422,7 +255982,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -254481,7 +256041,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -254580,7 +256140,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -254611,8 +256171,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -254638,7 +256198,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -254681,7 +256245,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -254728,8 +256296,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -254983,8 +256551,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -255150,7 +256718,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -255430,7 +256998,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -255451,15 +257019,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -255675,8 +257243,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -255690,13 +257258,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -255722,7 +257290,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -255781,7 +257349,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -255880,7 +257448,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -255911,8 +257479,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -255938,7 +257506,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -255981,7 +257553,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -256028,8 +257604,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -256283,8 +257859,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -256450,7 +258026,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -256730,7 +258306,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -256751,15 +258327,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -256975,8 +258551,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -256990,13 +258566,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -257022,7 +258598,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -257081,7 +258657,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -257180,7 +258756,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -257211,8 +258787,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -257238,7 +258814,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -257281,7 +258861,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -257328,8 +258912,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -257583,8 +259167,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -257750,7 +259334,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -258030,7 +259614,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -258051,15 +259635,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -258275,8 +259859,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -258290,13 +259874,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -258322,7 +259906,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -258381,7 +259965,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -258480,7 +260064,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -258511,8 +260095,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -258538,7 +260122,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -258581,7 +260169,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -258628,8 +260220,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -258883,8 +260475,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -259050,7 +260642,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -259330,7 +260922,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -259351,15 +260943,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -259575,8 +261167,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -259590,13 +261182,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -259622,7 +261214,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -259681,7 +261273,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -259780,7 +261372,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -259811,8 +261403,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -259838,7 +261430,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -259881,7 +261477,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -259928,8 +261528,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -260183,8 +261783,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -260350,7 +261950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -260630,7 +262230,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -260651,15 +262251,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -260875,8 +262475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -260890,13 +262490,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -260922,7 +262522,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -260981,7 +262581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -261080,7 +262680,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -261111,8 +262711,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -261138,7 +262738,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -261181,7 +262785,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -261228,8 +262836,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -261483,8 +263091,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -261650,7 +263258,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -261930,7 +263538,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -261951,15 +263559,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -262175,8 +263783,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -262190,13 +263798,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -262222,7 +263830,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -262281,7 +263889,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -262380,7 +263988,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -262411,8 +264019,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -262438,7 +264046,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -262481,7 +264093,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -262528,8 +264144,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -262783,8 +264399,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -262950,7 +264566,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -263230,7 +264846,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -263251,15 +264867,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -263475,8 +265091,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -263490,13 +265106,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -263522,7 +265138,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -263581,7 +265197,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -263680,7 +265296,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -263711,8 +265327,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -263738,7 +265354,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -263781,7 +265401,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -263828,8 +265452,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -264083,8 +265707,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -264250,7 +265874,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -264530,7 +266154,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -264551,15 +266175,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -264775,8 +266399,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -264790,13 +266414,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -264822,7 +266446,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -264881,7 +266505,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -264980,7 +266604,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -265011,8 +266635,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -265038,7 +266662,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -265081,7 +266709,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -265128,8 +266760,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -265383,8 +267015,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -265550,7 +267182,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -265830,7 +267462,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -265851,15 +267483,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -266075,8 +267707,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -266090,13 +267722,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -266122,7 +267754,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -266181,7 +267813,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -266280,7 +267912,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -266311,8 +267943,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -266338,7 +267970,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -266381,7 +268017,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -266428,8 +268068,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -266683,8 +268323,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -266850,7 +268490,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -267130,7 +268770,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -267151,15 +268791,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -267375,8 +269015,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -267390,13 +269030,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -267422,7 +269062,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -267481,7 +269121,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -267580,7 +269220,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -267611,8 +269251,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -267638,7 +269278,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -267681,7 +269325,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -267728,8 +269376,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -267983,8 +269631,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -268150,7 +269798,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -268430,7 +270078,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -268451,15 +270099,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -268675,8 +270323,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -268690,13 +270338,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -268722,7 +270370,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -268781,7 +270429,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -268880,7 +270528,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -268911,8 +270559,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -268938,7 +270586,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -268981,7 +270633,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -269028,8 +270684,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -269283,8 +270939,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -269450,7 +271106,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -269730,7 +271386,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -269751,15 +271407,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -269975,8 +271631,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -269990,13 +271646,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -270022,7 +271678,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -270081,7 +271737,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -270180,7 +271836,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -270211,8 +271867,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -270238,7 +271894,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -270281,7 +271941,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -270328,8 +271992,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -270583,8 +272247,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -270750,7 +272414,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -271030,7 +272694,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -271051,15 +272715,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -271275,8 +272939,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -271290,13 +272954,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -271322,7 +272986,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -271381,7 +273045,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -271480,7 +273144,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -271511,8 +273175,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -271538,7 +273202,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -271581,7 +273249,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -271628,8 +273300,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -271883,8 +273555,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -272050,7 +273722,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -272330,7 +274002,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -272351,15 +274023,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -272575,8 +274247,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -272590,13 +274262,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -272622,7 +274294,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -272681,7 +274353,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -272780,7 +274452,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -272811,8 +274483,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -272838,7 +274510,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -272881,7 +274557,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -272928,8 +274608,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -273183,8 +274863,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -273350,7 +275030,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -273630,7 +275310,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -273651,15 +275331,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -273875,8 +275555,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -273890,13 +275570,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -273922,7 +275602,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -273981,7 +275661,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -274080,7 +275760,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -274111,8 +275791,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -274138,7 +275818,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -274181,7 +275865,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -274228,8 +275916,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -274483,8 +276171,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -274650,7 +276338,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -274930,7 +276618,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -274951,15 +276639,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -275175,8 +276863,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -275190,13 +276878,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -275222,7 +276910,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -275281,7 +276969,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -275380,7 +277068,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -275411,8 +277099,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -275438,7 +277126,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -275481,7 +277173,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -275528,8 +277224,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -275783,8 +277479,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -275950,7 +277646,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -276230,7 +277926,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -276251,15 +277947,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -276475,8 +278171,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -276490,13 +278186,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -276522,7 +278218,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -276581,7 +278277,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -276680,7 +278376,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -276711,8 +278407,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -276738,7 +278434,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -276781,7 +278481,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -276828,8 +278532,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -277083,8 +278787,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -277250,7 +278954,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -277530,7 +279234,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -277551,15 +279255,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -277775,8 +279479,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -277790,13 +279494,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -277822,7 +279526,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -277881,7 +279585,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -277980,7 +279684,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -278011,8 +279715,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -278038,7 +279742,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -278081,7 +279789,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -278128,8 +279840,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -278383,8 +280095,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -278550,7 +280262,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -278830,7 +280542,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -278851,15 +280563,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -279075,8 +280787,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -279090,13 +280802,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -279122,7 +280834,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -279181,7 +280893,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -279280,7 +280992,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -279311,8 +281023,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -279338,7 +281050,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -279381,7 +281097,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -279428,8 +281148,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -279683,8 +281403,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -279850,7 +281570,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -280130,7 +281850,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -280151,15 +281871,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -280375,8 +282095,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -280390,13 +282110,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -280422,7 +282142,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -280481,7 +282201,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -280580,7 +282300,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -280611,8 +282331,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -280638,7 +282358,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -280681,7 +282405,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -280728,8 +282456,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -280983,8 +282711,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -281150,7 +282878,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -281430,7 +283158,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -281451,15 +283179,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -281675,8 +283403,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -281690,13 +283418,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -281722,7 +283450,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -281781,7 +283509,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -281880,7 +283608,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -281911,8 +283639,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -281938,7 +283666,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -281981,7 +283713,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -282028,8 +283764,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -282283,8 +284019,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -282450,7 +284186,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -282730,7 +284466,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -282751,15 +284487,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -282975,8 +284711,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -282990,13 +284726,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -283022,7 +284758,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -283081,7 +284817,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -283180,7 +284916,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -283211,8 +284947,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -283238,7 +284974,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -283281,7 +285021,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -283328,8 +285072,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -283583,8 +285327,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -283750,7 +285494,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -284030,7 +285774,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -284051,15 +285795,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -284275,8 +286019,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -284290,13 +286034,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -284322,7 +286066,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -284381,7 +286125,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -284480,7 +286224,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -284511,8 +286255,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -284538,7 +286282,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -284581,7 +286329,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -284628,8 +286380,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -284883,8 +286635,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -285050,7 +286802,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -285330,7 +287082,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -285351,15 +287103,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -285575,8 +287327,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -285590,13 +287342,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -285622,7 +287374,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -285681,7 +287433,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -285780,7 +287532,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -285811,8 +287563,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -285838,7 +287590,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -285881,7 +287637,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -285928,8 +287688,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -286183,8 +287943,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -286350,7 +288110,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -286630,7 +288390,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -286651,15 +288411,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -286875,8 +288635,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -286890,13 +288650,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -286922,7 +288682,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -286981,7 +288741,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -287080,7 +288840,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -287111,8 +288871,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -287138,7 +288898,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -287181,7 +288945,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -287228,8 +288996,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -287483,8 +289251,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -287650,7 +289418,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -287930,7 +289698,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -287951,15 +289719,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -288175,8 +289943,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -288190,13 +289958,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -288222,7 +289990,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -288281,7 +290049,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -288380,7 +290148,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -288411,8 +290179,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -288438,7 +290206,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -288481,7 +290253,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -288528,8 +290304,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -288783,8 +290559,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -288950,7 +290726,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -289230,7 +291006,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -289251,15 +291027,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -289475,8 +291251,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -289490,13 +291266,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -289522,7 +291298,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -289581,7 +291357,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -289680,7 +291456,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -289711,8 +291487,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -289738,7 +291514,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -289781,7 +291561,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -289828,8 +291612,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -290083,8 +291867,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -290250,7 +292034,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -290530,7 +292314,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -290551,15 +292335,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -290775,8 +292559,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -290790,13 +292574,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -290822,7 +292606,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -290881,7 +292665,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -290980,7 +292764,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -291011,8 +292795,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -291038,7 +292822,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -291081,7 +292869,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -291128,8 +292920,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -291383,8 +293175,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -291550,7 +293342,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -291830,7 +293622,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -291851,15 +293643,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -292075,8 +293867,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -292090,13 +293882,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -292122,7 +293914,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -292181,7 +293973,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -292280,7 +294072,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -292311,8 +294103,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -292338,7 +294130,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -292381,7 +294177,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -292428,8 +294228,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -292683,8 +294483,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -292850,7 +294650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -293130,7 +294930,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -293151,15 +294951,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -293375,8 +295175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -293390,13 +295190,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -293422,7 +295222,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -293481,7 +295281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -293580,7 +295380,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -293611,8 +295411,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -293638,7 +295438,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -293681,7 +295485,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -293728,8 +295536,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -293983,8 +295791,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -294150,7 +295958,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -294430,7 +296238,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -294451,15 +296259,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -294675,8 +296483,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -294690,13 +296498,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -294722,7 +296530,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -294781,7 +296589,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -294880,7 +296688,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -294911,8 +296719,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -294938,7 +296746,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -294981,7 +296793,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -295028,8 +296844,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -295283,8 +297099,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -295450,7 +297266,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -295730,7 +297546,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -295751,15 +297567,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -295975,8 +297791,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -295990,13 +297806,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -296022,7 +297838,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -296081,7 +297897,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -296180,7 +297996,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -296211,8 +298027,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -296238,7 +298054,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -296281,7 +298101,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -296328,8 +298152,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -296583,8 +298407,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -296750,7 +298574,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -297030,7 +298854,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -297051,15 +298875,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -297275,8 +299099,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -297290,13 +299114,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -297322,7 +299146,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -297381,7 +299205,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -297480,7 +299304,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -297511,8 +299335,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -297538,7 +299362,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -297581,7 +299409,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -297628,8 +299460,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -297883,8 +299715,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -298050,7 +299882,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -298330,7 +300162,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -298351,15 +300183,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -298575,8 +300407,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -298590,13 +300422,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -298622,7 +300454,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -298681,7 +300513,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -298780,7 +300612,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -298811,8 +300643,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -298838,7 +300670,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -298881,7 +300717,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -298928,8 +300768,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -299183,8 +301023,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -299350,7 +301190,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -299630,7 +301470,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -299651,15 +301491,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -299875,8 +301715,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -299890,13 +301730,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -299922,7 +301762,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -299981,7 +301821,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -300080,7 +301920,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -300111,8 +301951,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -300138,7 +301978,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -300181,7 +302025,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -300228,8 +302076,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -300483,8 +302331,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -300650,7 +302498,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -300930,7 +302778,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -300951,15 +302799,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -301175,8 +303023,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -301190,13 +303038,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -301222,7 +303070,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -301281,7 +303129,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -301380,7 +303228,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -301411,8 +303259,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -301438,7 +303286,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -301481,7 +303333,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -301528,8 +303384,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -301783,8 +303639,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -301950,7 +303806,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -302230,7 +304086,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -302251,15 +304107,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -302475,8 +304331,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -302490,13 +304346,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -302522,7 +304378,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -302581,7 +304437,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -302680,7 +304536,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -302711,8 +304567,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -302738,7 +304594,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -302781,7 +304641,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -302828,8 +304692,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -303083,8 +304947,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -303250,7 +305114,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -303530,7 +305394,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -303551,15 +305415,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -303775,8 +305639,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -303790,13 +305654,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -303822,7 +305686,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -303881,7 +305745,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -303980,7 +305844,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -304011,8 +305875,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -304038,7 +305902,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -304081,7 +305949,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -304128,8 +306000,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -304383,8 +306255,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -304550,7 +306422,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -304830,7 +306702,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -304851,15 +306723,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -305075,8 +306947,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -305090,13 +306962,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -305122,7 +306994,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -305181,7 +307053,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -305280,7 +307152,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -305311,8 +307183,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -305338,7 +307210,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -305381,7 +307257,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -305428,8 +307308,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -305683,8 +307563,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -305850,7 +307730,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -306130,7 +308010,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -306151,15 +308031,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -306375,8 +308255,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -306390,13 +308270,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -306422,7 +308302,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -306481,7 +308361,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -306580,7 +308460,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -306611,8 +308491,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -306638,7 +308518,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -306681,7 +308565,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -306728,8 +308616,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -306983,8 +308871,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -307150,7 +309038,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -307430,7 +309318,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -307451,15 +309339,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -307675,8 +309563,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -307690,13 +309578,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -307722,7 +309610,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -307781,7 +309669,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -307880,7 +309768,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -307911,8 +309799,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -307938,7 +309826,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -307981,7 +309873,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -308028,8 +309924,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -308283,8 +310179,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -308450,7 +310346,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -308730,7 +310626,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -308751,15 +310647,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -308975,8 +310871,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -308990,13 +310886,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -309022,7 +310918,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -309081,7 +310977,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -309180,7 +311076,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -309211,8 +311107,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -309238,7 +311134,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -309281,7 +311181,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -309328,8 +311232,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -309583,8 +311487,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -309750,7 +311654,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -310030,7 +311934,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -310051,15 +311955,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -310275,8 +312179,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -310290,13 +312194,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -310322,7 +312226,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -310381,7 +312285,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -310480,7 +312384,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -310511,8 +312415,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -310538,7 +312442,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -310581,7 +312489,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -310628,8 +312540,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -310883,8 +312795,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -311050,7 +312962,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -311330,7 +313242,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -311351,15 +313263,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -311575,8 +313487,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -311590,13 +313502,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -311622,7 +313534,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -311681,7 +313593,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -311780,7 +313692,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -311811,8 +313723,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -311838,7 +313750,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -311881,7 +313797,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -311928,8 +313848,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -312183,8 +314103,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -312350,7 +314270,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -312630,7 +314550,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -312651,15 +314571,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -312875,8 +314795,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -312890,13 +314810,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -312922,7 +314842,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -312981,7 +314901,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -313080,7 +315000,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -313111,8 +315031,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -313138,7 +315058,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -313181,7 +315105,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -313228,8 +315156,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -313483,8 +315411,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -313650,7 +315578,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -313930,7 +315858,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -313951,15 +315879,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -314175,8 +316103,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -314190,13 +316118,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -314222,7 +316150,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -314281,7 +316209,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -314380,7 +316308,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -314411,8 +316339,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -314438,7 +316366,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -314481,7 +316413,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -314528,8 +316464,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -314783,8 +316719,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -314950,7 +316886,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -315230,7 +317166,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -315251,15 +317187,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -315475,8 +317411,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -315490,13 +317426,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -315522,7 +317458,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -315581,7 +317517,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -315680,7 +317616,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -315711,8 +317647,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -315738,7 +317674,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -315781,7 +317721,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -315828,8 +317772,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -316083,8 +318027,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -316250,7 +318194,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -316530,7 +318474,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -316551,15 +318495,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -316775,8 +318719,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -316790,13 +318734,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -316822,7 +318766,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -316881,7 +318825,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -316980,7 +318924,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -317011,8 +318955,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -317038,7 +318982,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -317081,7 +319029,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -317128,8 +319080,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -317383,8 +319335,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -317550,7 +319502,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -317830,7 +319782,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -317851,15 +319803,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -318075,8 +320027,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -318090,13 +320042,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -318122,7 +320074,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -318181,7 +320133,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -318280,7 +320232,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -318311,8 +320263,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -318338,7 +320290,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -318381,7 +320337,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -318428,8 +320388,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -318683,8 +320643,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -318850,7 +320810,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -319130,7 +321090,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -319151,15 +321111,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -319375,8 +321335,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -319390,13 +321350,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -319422,7 +321382,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -319481,7 +321441,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -319580,7 +321540,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -319611,8 +321571,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -319638,7 +321598,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -319681,7 +321645,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -319728,8 +321696,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -319983,8 +321951,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -320150,7 +322118,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -320430,7 +322398,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -320451,15 +322419,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -320675,8 +322643,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -320690,13 +322658,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -320722,7 +322690,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -320781,7 +322749,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -320880,7 +322848,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -320911,8 +322879,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -320938,7 +322906,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -320981,7 +322953,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -321028,8 +323004,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -321283,8 +323259,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -321450,7 +323426,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -321730,7 +323706,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -321751,15 +323727,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -321975,8 +323951,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -321990,13 +323966,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -322022,7 +323998,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -322081,7 +324057,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -322180,7 +324156,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -322211,8 +324187,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -322238,7 +324214,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -322281,7 +324261,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -322328,8 +324312,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -322583,8 +324567,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -322750,7 +324734,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -323030,7 +325014,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -323051,15 +325035,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -323275,8 +325259,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -323290,13 +325274,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -323322,7 +325306,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -323381,7 +325365,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -323480,7 +325464,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -323511,8 +325495,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -323538,7 +325522,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -323581,7 +325569,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -323628,8 +325620,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -323883,8 +325875,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -324050,7 +326042,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -324330,7 +326322,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -324351,15 +326343,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -324575,8 +326567,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -324590,13 +326582,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -324622,7 +326614,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -324681,7 +326673,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -324780,7 +326772,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -324811,8 +326803,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -324838,7 +326830,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -324881,7 +326877,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -324928,8 +326928,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -325183,8 +327183,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -325350,7 +327350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -325630,7 +327630,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -325651,15 +327651,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -325875,8 +327875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -325890,13 +327890,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -325922,7 +327922,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -325981,7 +327981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -326080,7 +328080,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -326111,8 +328111,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -326138,7 +328138,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -326181,7 +328185,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -326228,8 +328236,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -326483,8 +328491,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -326650,7 +328658,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -326930,7 +328938,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -326951,15 +328959,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -327175,8 +329183,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -327190,13 +329198,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -327222,7 +329230,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -327281,7 +329289,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -327380,7 +329388,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -327411,8 +329419,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -327438,7 +329446,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -327481,7 +329493,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -327528,8 +329544,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -327783,8 +329799,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -327950,7 +329966,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -328230,7 +330246,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -328251,15 +330267,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -328475,8 +330491,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -328490,13 +330506,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -328522,7 +330538,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -328581,7 +330597,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -328680,7 +330696,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -328711,8 +330727,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -328738,7 +330754,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -328781,7 +330801,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -328828,8 +330852,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -329083,8 +331107,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -329250,7 +331274,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -329530,7 +331554,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -329551,15 +331575,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -329775,8 +331799,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -329790,13 +331814,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -329822,7 +331846,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -329881,7 +331905,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -329980,7 +332004,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -330011,8 +332035,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -330038,7 +332062,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -330081,7 +332109,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -330128,8 +332160,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -330383,8 +332415,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -330550,7 +332582,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -330830,7 +332862,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -330851,15 +332883,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -331075,8 +333107,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -331090,13 +333122,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -331122,7 +333154,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -331181,7 +333213,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -331280,7 +333312,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -331311,8 +333343,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -331338,7 +333370,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -331381,7 +333417,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -331428,8 +333468,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -331683,8 +333723,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -331850,7 +333890,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -332130,7 +334170,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -332151,15 +334191,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -332375,8 +334415,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -332390,13 +334430,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -332422,7 +334462,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -332481,7 +334521,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -332580,7 +334620,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -332611,8 +334651,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -332638,7 +334678,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -332681,7 +334725,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -332728,8 +334776,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -332983,8 +335031,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -333150,7 +335198,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -333430,7 +335478,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -333451,15 +335499,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -333675,8 +335723,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -333690,13 +335738,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -333722,7 +335770,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -333781,7 +335829,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -333880,7 +335928,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -333911,8 +335959,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -333938,7 +335986,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -333981,7 +336033,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -334028,8 +336084,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -334283,8 +336339,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -334450,7 +336506,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -334730,7 +336786,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -334751,15 +336807,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -334975,8 +337031,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -334990,13 +337046,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -335022,7 +337078,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -335081,7 +337137,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -335180,7 +337236,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -335211,8 +337267,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -335238,7 +337294,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -335281,7 +337341,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -335328,8 +337392,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -335583,8 +337647,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -335750,7 +337814,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -336030,7 +338094,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -336051,15 +338115,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -336275,8 +338339,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -336290,13 +338354,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -336322,7 +338386,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -336381,7 +338445,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -336480,7 +338544,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -336511,8 +338575,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -336538,7 +338602,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -336581,7 +338649,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -336628,8 +338700,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -336883,8 +338955,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -337050,7 +339122,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -337330,7 +339402,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -337351,15 +339423,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -337575,8 +339647,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -337590,13 +339662,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -337622,7 +339694,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -337681,7 +339753,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -337780,7 +339852,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -337811,8 +339883,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -337838,7 +339910,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -337881,7 +339957,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -337928,8 +340008,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -338183,8 +340263,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -338350,7 +340430,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -338630,7 +340710,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -338651,15 +340731,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -338875,8 +340955,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -338890,13 +340970,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -338922,7 +341002,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -338981,7 +341061,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -339080,7 +341160,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -339111,8 +341191,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -339138,7 +341218,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -339181,7 +341265,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -339228,8 +341316,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -339483,8 +341571,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -339650,7 +341738,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -339930,7 +342018,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -339951,15 +342039,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -340175,8 +342263,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -340190,13 +342278,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -340222,7 +342310,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -340281,7 +342369,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -340380,7 +342468,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -340411,8 +342499,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -340438,7 +342526,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -340481,7 +342573,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -340528,8 +342624,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -340783,8 +342879,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -340950,7 +343046,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -341230,7 +343326,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -341251,15 +343347,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -341475,8 +343571,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -341490,13 +343586,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -341522,7 +343618,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -341581,7 +343677,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -341680,7 +343776,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -341711,8 +343807,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -341738,7 +343834,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -341781,7 +343881,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -341828,8 +343932,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -342083,8 +344187,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -342250,7 +344354,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -342530,7 +344634,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -342551,15 +344655,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -342775,8 +344879,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -342790,13 +344894,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -342822,7 +344926,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -342881,7 +344985,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -342980,7 +345084,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -343011,8 +345115,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -343038,7 +345142,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -343081,7 +345189,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -343128,8 +345240,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -343383,8 +345495,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -343550,7 +345662,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -343830,7 +345942,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -343851,15 +345963,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -344075,8 +346187,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -344090,13 +346202,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -344122,7 +346234,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -344181,7 +346293,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -344280,7 +346392,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -344311,8 +346423,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -344338,7 +346450,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -344381,7 +346497,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -344428,8 +346548,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -344683,8 +346803,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -344850,7 +346970,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -345130,7 +347250,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -345151,15 +347271,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -345375,8 +347495,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -345390,13 +347510,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -345422,7 +347542,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -345481,7 +347601,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -345580,7 +347700,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -345611,8 +347731,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -345638,7 +347758,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -345681,7 +347805,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -345728,8 +347856,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -345983,8 +348111,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -346150,7 +348278,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -346430,7 +348558,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -346451,15 +348579,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -346675,8 +348803,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -346690,13 +348818,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -346722,7 +348850,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -346781,7 +348909,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -346880,7 +349008,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -346911,8 +349039,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -346938,7 +349066,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -346981,7 +349113,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -347028,8 +349164,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -347283,8 +349419,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -347450,7 +349586,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -347730,7 +349866,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -347751,15 +349887,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -347975,8 +350111,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -347990,13 +350126,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -348022,7 +350158,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -348081,7 +350217,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -348180,7 +350316,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -348211,8 +350347,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -348238,7 +350374,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -348281,7 +350421,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -348328,8 +350472,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -348583,8 +350727,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -348750,7 +350894,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -349030,7 +351174,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -349051,15 +351195,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -349275,8 +351419,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -349290,13 +351434,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -349322,7 +351466,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -349381,7 +351525,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -349480,7 +351624,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -349511,8 +351655,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -349538,7 +351682,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -349581,7 +351729,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -349628,8 +351780,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -349883,8 +352035,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -350050,7 +352202,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -350330,7 +352482,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -350351,15 +352503,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -350575,8 +352727,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -350590,13 +352742,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -350622,7 +352774,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -350681,7 +352833,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -350780,7 +352932,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -350811,8 +352963,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -350838,7 +352990,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -350881,7 +353037,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -350928,8 +353088,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -351183,8 +353343,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -351350,7 +353510,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -351630,7 +353790,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -351651,15 +353811,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -351875,8 +354035,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -351890,13 +354050,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -351922,7 +354082,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -351981,7 +354141,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -352080,7 +354240,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -352111,8 +354271,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -352138,7 +354298,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -352181,7 +354345,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -352228,8 +354396,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -352483,8 +354651,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -352650,7 +354818,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -352930,7 +355098,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -352951,15 +355119,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -353175,8 +355343,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -353190,13 +355358,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -353222,7 +355390,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -353281,7 +355449,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -353380,7 +355548,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -353411,8 +355579,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -353438,7 +355606,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -353481,7 +355653,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -353528,8 +355704,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -353783,8 +355959,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -353950,7 +356126,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -354230,7 +356406,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -354251,15 +356427,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -354475,8 +356651,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -354490,13 +356666,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -354522,7 +356698,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -354581,7 +356757,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -354680,7 +356856,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -354711,8 +356887,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -354738,7 +356914,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -354781,7 +356961,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -354828,8 +357012,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -355083,8 +357267,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -355250,7 +357434,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -355530,7 +357714,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -355551,15 +357735,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -355775,8 +357959,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -355790,13 +357974,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -355822,7 +358006,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -355881,7 +358065,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -355980,7 +358164,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -356011,8 +358195,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -356038,7 +358222,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -356081,7 +358269,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -356128,8 +358320,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -356383,8 +358575,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -356550,7 +358742,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -356830,7 +359022,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -356851,15 +359043,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -357075,8 +359267,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -357090,13 +359282,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -357122,7 +359314,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -357181,7 +359373,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -357280,7 +359472,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -357311,8 +359503,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -357338,7 +359530,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -357381,7 +359577,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -357428,8 +359628,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -357683,8 +359883,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -357850,7 +360050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -358130,7 +360330,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -358151,15 +360351,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -358375,8 +360575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -358390,13 +360590,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -358422,7 +360622,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -358481,7 +360681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -358580,7 +360780,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -358611,8 +360811,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -358638,7 +360838,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -358681,7 +360885,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -358728,8 +360936,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -358983,8 +361191,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -359150,7 +361358,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -359430,7 +361638,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -359451,15 +361659,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -359675,8 +361883,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -359690,13 +361898,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -359722,7 +361930,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -359781,7 +361989,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -359880,7 +362088,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -359911,8 +362119,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -359938,7 +362146,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -359981,7 +362193,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -360028,8 +362244,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -360283,8 +362499,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -360450,7 +362666,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -360730,7 +362946,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -360751,15 +362967,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -360975,8 +363191,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -360990,13 +363206,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -361022,7 +363238,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -361081,7 +363297,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -361180,7 +363396,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -361211,8 +363427,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -361238,7 +363454,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -361281,7 +363501,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -361328,8 +363552,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -361583,8 +363807,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -361750,7 +363974,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -362030,7 +364254,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -362051,15 +364275,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -362275,8 +364499,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -362290,13 +364514,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -362322,7 +364546,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -362381,7 +364605,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -362480,7 +364704,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -362511,8 +364735,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -362538,7 +364762,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -362581,7 +364809,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -362628,8 +364860,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -362883,8 +365115,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -363050,7 +365282,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -363330,7 +365562,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -363351,15 +365583,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -363575,8 +365807,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -363590,13 +365822,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -363622,7 +365854,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -363681,7 +365913,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -363780,7 +366012,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -363811,8 +366043,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -363838,7 +366070,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -363881,7 +366117,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -363928,8 +366168,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -364183,8 +366423,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -364350,7 +366590,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -364630,7 +366870,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -364651,15 +366891,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -364875,8 +367115,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -364890,13 +367130,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -364922,7 +367162,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -364981,7 +367221,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -365080,7 +367320,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -365111,8 +367351,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -365138,7 +367378,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -365181,7 +367425,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -365228,8 +367476,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -365483,8 +367731,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -365650,7 +367898,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -365930,7 +368178,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -365951,15 +368199,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -366175,8 +368423,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -366190,13 +368438,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -366222,7 +368470,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -366281,7 +368529,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -366380,7 +368628,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -366411,8 +368659,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -366438,7 +368686,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -366481,7 +368733,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -366528,8 +368784,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -366783,8 +369039,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -366950,7 +369206,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -367230,7 +369486,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -367251,15 +369507,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -367475,8 +369731,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -367490,13 +369746,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -367522,7 +369778,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -367581,7 +369837,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -367680,7 +369936,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -367711,8 +369967,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -367738,7 +369994,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -367781,7 +370041,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -367828,8 +370092,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -368083,8 +370347,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -368250,7 +370514,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -368530,7 +370794,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -368551,15 +370815,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -368775,8 +371039,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -368790,13 +371054,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -368822,7 +371086,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -368881,7 +371145,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -368980,7 +371244,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -369011,8 +371275,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -369038,7 +371302,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -369081,7 +371349,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -369128,8 +371400,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -369383,8 +371655,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -369550,7 +371822,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -369830,7 +372102,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -369851,15 +372123,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -370075,8 +372347,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -370090,13 +372362,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -370122,7 +372394,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -370181,7 +372453,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -370280,7 +372552,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -370311,8 +372583,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -370338,7 +372610,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -370381,7 +372657,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -370428,8 +372708,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -370683,8 +372963,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -370850,7 +373130,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -371130,7 +373410,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -371151,15 +373431,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -371375,8 +373655,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -371390,13 +373670,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -371422,7 +373702,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -371481,7 +373761,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -371580,7 +373860,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -371611,8 +373891,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -371638,7 +373918,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -371681,7 +373965,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -371728,8 +374016,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -371983,8 +374271,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -372150,7 +374438,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -372430,7 +374718,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -372451,15 +374739,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -372675,8 +374963,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -372690,13 +374978,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -372722,7 +375010,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -372781,7 +375069,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -372880,7 +375168,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -372911,8 +375199,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -372938,7 +375226,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -372981,7 +375273,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -373028,8 +375324,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -373283,8 +375579,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -373450,7 +375746,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -373730,7 +376026,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -373751,15 +376047,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -373975,8 +376271,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -373990,13 +376286,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -374022,7 +376318,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -374081,7 +376377,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -374180,7 +376476,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -374211,8 +376507,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -374238,7 +376534,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -374281,7 +376581,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -374328,8 +376632,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -374583,8 +376887,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -374750,7 +377054,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -375030,7 +377334,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -375051,15 +377355,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -375275,8 +377579,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -375290,13 +377594,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -375322,7 +377626,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -375381,7 +377685,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -375480,7 +377784,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -375511,8 +377815,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -375538,7 +377842,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -375581,7 +377889,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -375628,8 +377940,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -375883,8 +378195,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -376050,7 +378362,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -376330,7 +378642,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -376351,15 +378663,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -376575,8 +378887,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -376590,13 +378902,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -376622,7 +378934,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -376681,7 +378993,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -376780,7 +379092,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -376811,8 +379123,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -376838,7 +379150,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -376881,7 +379197,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -376928,8 +379248,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -377183,8 +379503,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -377350,7 +379670,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -377630,7 +379950,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -377651,15 +379971,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -377875,8 +380195,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -377890,13 +380210,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -377922,7 +380242,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -377981,7 +380301,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -378080,7 +380400,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -378111,8 +380431,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -378138,7 +380458,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -378181,7 +380505,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -378228,8 +380556,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -378483,8 +380811,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -378650,7 +380978,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -378930,7 +381258,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -378951,15 +381279,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -379175,8 +381503,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -379190,13 +381518,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -379222,7 +381550,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -379281,7 +381609,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -379380,7 +381708,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -379411,8 +381739,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -379438,7 +381766,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -379481,7 +381813,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -379528,8 +381864,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -379783,8 +382119,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -379950,7 +382286,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -380230,7 +382566,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -380251,15 +382587,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -380475,8 +382811,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -380490,13 +382826,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -380522,7 +382858,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -380581,7 +382917,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -380680,7 +383016,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -380711,8 +383047,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -380738,7 +383074,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -380781,7 +383121,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -380828,8 +383172,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -381083,8 +383427,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -381250,7 +383594,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -381530,7 +383874,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -381551,15 +383895,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -381775,8 +384119,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -381790,13 +384134,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -381822,7 +384166,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -381881,7 +384225,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -381980,7 +384324,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -382011,8 +384355,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -382038,7 +384382,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -382081,7 +384429,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -382128,8 +384480,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -382383,8 +384735,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -382550,7 +384902,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -382830,7 +385182,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -382851,15 +385203,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -383075,8 +385427,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -383090,13 +385442,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -383122,7 +385474,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -383181,7 +385533,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -383280,7 +385632,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -383311,8 +385663,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -383338,7 +385690,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -383381,7 +385737,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -383428,8 +385788,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -383683,8 +386043,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -383850,7 +386210,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -384130,7 +386490,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -384151,15 +386511,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -384375,8 +386735,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -384390,13 +386750,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -384422,7 +386782,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -384481,7 +386841,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -384580,7 +386940,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -384611,8 +386971,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -384638,7 +386998,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -384681,7 +387045,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -384728,8 +387096,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -384983,8 +387351,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -385150,7 +387518,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -385430,7 +387798,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -385451,15 +387819,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -385675,8 +388043,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -385690,13 +388058,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -385722,7 +388090,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -385781,7 +388149,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -385880,7 +388248,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -385911,8 +388279,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -385938,7 +388306,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -385981,7 +388353,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -386028,8 +388404,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -386283,8 +388659,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -386450,7 +388826,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -386730,7 +389106,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -386751,15 +389127,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -386975,8 +389351,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -386990,13 +389366,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -387022,7 +389398,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -387081,7 +389457,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -387180,7 +389556,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -387211,8 +389587,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -387238,7 +389614,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -387281,7 +389661,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -387328,8 +389712,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -387583,8 +389967,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -387750,7 +390134,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -388030,7 +390414,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -388051,15 +390435,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -388275,8 +390659,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -388290,13 +390674,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -388322,7 +390706,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -388381,7 +390765,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -388480,7 +390864,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -388511,8 +390895,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -388538,7 +390922,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -388581,7 +390969,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -388628,8 +391020,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -388883,8 +391275,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -389050,7 +391442,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -389330,7 +391722,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -389351,15 +391743,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -389575,8 +391967,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -389590,13 +391982,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -389622,7 +392014,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -389681,7 +392073,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -389780,7 +392172,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -389811,8 +392203,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -389838,7 +392230,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -389881,7 +392277,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -389928,8 +392328,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -390183,8 +392583,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -390350,7 +392750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -390630,7 +393030,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -390651,15 +393051,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -390875,8 +393275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -390890,13 +393290,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -390922,7 +393322,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -390981,7 +393381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -391080,7 +393480,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -391111,8 +393511,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -391138,7 +393538,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -391181,7 +393585,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -391228,8 +393636,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -391483,8 +393891,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -391650,7 +394058,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -391930,7 +394338,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -391951,15 +394359,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -392175,8 +394583,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -392190,13 +394598,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -392222,7 +394630,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -392281,7 +394689,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -392380,7 +394788,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -392411,8 +394819,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -392438,7 +394846,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -392481,7 +394893,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -392528,8 +394944,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -392783,8 +395199,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -392950,7 +395366,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -393230,7 +395646,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -393251,15 +395667,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -393475,8 +395891,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -393490,13 +395906,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -393522,7 +395938,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -393581,7 +395997,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -393680,7 +396096,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -393711,8 +396127,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -393738,7 +396154,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -393781,7 +396201,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -393828,8 +396252,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -394083,8 +396507,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -394250,7 +396674,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -394530,7 +396954,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -394551,15 +396975,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -394775,8 +397199,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -394790,13 +397214,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -394822,7 +397246,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -394881,7 +397305,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -394980,7 +397404,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -395011,8 +397435,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -395038,7 +397462,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -395081,7 +397509,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -395128,8 +397560,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -395383,8 +397815,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -395550,7 +397982,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -395830,7 +398262,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -395851,15 +398283,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -396075,8 +398507,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -396090,13 +398522,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -396122,7 +398554,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -396181,7 +398613,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -396280,7 +398712,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -396311,8 +398743,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -396338,7 +398770,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -396381,7 +398817,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -396428,8 +398868,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -396683,8 +399123,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -396850,7 +399290,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -397130,7 +399570,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -397151,15 +399591,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -397375,8 +399815,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -397390,13 +399830,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -397422,7 +399862,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -397481,7 +399921,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -397580,7 +400020,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -397611,8 +400051,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -397638,7 +400078,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -397681,7 +400125,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -397728,8 +400176,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -397983,8 +400431,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -398150,7 +400598,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -398430,7 +400878,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -398451,15 +400899,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -398675,8 +401123,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -398690,13 +401138,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -398722,7 +401170,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -398781,7 +401229,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -398880,7 +401328,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -398911,8 +401359,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -398938,7 +401386,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -398981,7 +401433,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -399028,8 +401484,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -399283,8 +401739,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -399450,7 +401906,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -399730,7 +402186,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -399751,15 +402207,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -399975,8 +402431,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -399990,13 +402446,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -400022,7 +402478,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -400081,7 +402537,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -400180,7 +402636,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -400211,8 +402667,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -400238,7 +402694,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -400281,7 +402741,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -400328,8 +402792,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -400583,8 +403047,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -400750,7 +403214,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -401030,7 +403494,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -401051,15 +403515,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -401275,8 +403739,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -401290,13 +403754,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -401322,7 +403786,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -401381,7 +403845,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -401480,7 +403944,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -401511,8 +403975,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -401538,7 +404002,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -401581,7 +404049,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -401628,8 +404100,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -401883,8 +404355,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -402050,7 +404522,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -402330,7 +404802,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -402351,15 +404823,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -402575,8 +405047,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -402590,13 +405062,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -402622,7 +405094,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -402681,7 +405153,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -402780,7 +405252,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -402811,8 +405283,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -402838,7 +405310,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -402881,7 +405357,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -402928,8 +405408,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -403183,8 +405663,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -403350,7 +405830,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -403630,7 +406110,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -403651,15 +406131,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -403875,8 +406355,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -403890,13 +406370,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -403922,7 +406402,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -403981,7 +406461,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -404080,7 +406560,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -404111,8 +406591,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -404138,7 +406618,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -404181,7 +406665,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -404228,8 +406716,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -404483,8 +406971,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -404650,7 +407138,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -404930,7 +407418,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -404951,15 +407439,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -405175,8 +407663,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -405190,13 +407678,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -405222,7 +407710,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -405281,7 +407769,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -405380,7 +407868,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -405411,8 +407899,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -405438,7 +407926,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -405481,7 +407973,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -405528,8 +408024,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -405783,8 +408279,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -405950,7 +408446,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -406230,7 +408726,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -406251,15 +408747,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -406475,8 +408971,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -406490,13 +408986,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -406522,7 +409018,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -406581,7 +409077,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -406680,7 +409176,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -406711,8 +409207,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -406738,7 +409234,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -406781,7 +409281,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -406828,8 +409332,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -407083,8 +409587,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -407250,7 +409754,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -407530,7 +410034,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -407551,15 +410055,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -407775,8 +410279,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -407790,13 +410294,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -407822,7 +410326,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -407881,7 +410385,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -407980,7 +410484,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -408011,8 +410515,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -408038,7 +410542,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -408081,7 +410589,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -408128,8 +410640,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -408383,8 +410895,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -408550,7 +411062,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -408830,7 +411342,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -408851,15 +411363,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -409075,8 +411587,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -409090,13 +411602,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -409122,7 +411634,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -409181,7 +411693,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -409280,7 +411792,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -409311,8 +411823,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -409338,7 +411850,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -409381,7 +411897,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -409428,8 +411948,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -409683,8 +412203,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -409850,7 +412370,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -410130,7 +412650,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -410151,15 +412671,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -410375,8 +412895,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -410390,13 +412910,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -410422,7 +412942,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -410481,7 +413001,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -410580,7 +413100,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -410611,8 +413131,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -410638,7 +413158,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -410681,7 +413205,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -410728,8 +413256,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -410983,8 +413511,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -411150,7 +413678,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -411430,7 +413958,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -411451,15 +413979,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -411675,8 +414203,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -411690,13 +414218,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -411722,7 +414250,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -411781,7 +414309,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -411880,7 +414408,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -411911,8 +414439,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -411938,7 +414466,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -411981,7 +414513,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -412028,8 +414564,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -412283,8 +414819,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -412450,7 +414986,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -412730,7 +415266,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -412751,15 +415287,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -412975,8 +415511,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -412990,13 +415526,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -413022,7 +415558,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -413081,7 +415617,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -413180,7 +415716,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -413211,8 +415747,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -413238,7 +415774,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -413281,7 +415821,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -413328,8 +415872,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -413583,8 +416127,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -413750,7 +416294,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -414030,7 +416574,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -414051,15 +416595,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -414275,8 +416819,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -414290,13 +416834,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -414322,7 +416866,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -414381,7 +416925,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -414480,7 +417024,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -414511,8 +417055,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -414538,7 +417082,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -414581,7 +417129,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -414628,8 +417180,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -414883,8 +417435,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -415050,7 +417602,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -415330,7 +417882,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -415351,15 +417903,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -415575,8 +418127,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -415590,13 +418142,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -415622,7 +418174,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -415681,7 +418233,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -415780,7 +418332,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -415811,8 +418363,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -415838,7 +418390,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -415881,7 +418437,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -415928,8 +418488,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -416183,8 +418743,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -416350,7 +418910,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -416630,7 +419190,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -416651,15 +419211,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -416875,8 +419435,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -416890,13 +419450,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -416922,7 +419482,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -416981,7 +419541,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -417080,7 +419640,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -417111,8 +419671,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -417138,7 +419698,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -417181,7 +419745,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -417228,8 +419796,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -417483,8 +420051,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -417650,7 +420218,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -417930,7 +420498,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -417951,15 +420519,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -418175,8 +420743,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -418190,13 +420758,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -418222,7 +420790,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -418281,7 +420849,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -418380,7 +420948,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -418411,8 +420979,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -418438,7 +421006,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -418481,7 +421053,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -418528,8 +421104,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -418783,8 +421359,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -418950,7 +421526,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -419230,7 +421806,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -419251,15 +421827,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -419475,8 +422051,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -419490,13 +422066,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -419522,7 +422098,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -419581,7 +422157,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -419680,7 +422256,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -419711,8 +422287,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -419738,7 +422314,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -419781,7 +422361,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -419828,8 +422412,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -420083,8 +422667,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -420250,7 +422834,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -420530,7 +423114,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -420551,15 +423135,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -420775,8 +423359,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -420790,13 +423374,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -420822,7 +423406,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -420881,7 +423465,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -420980,7 +423564,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -421011,8 +423595,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -421038,7 +423622,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -421081,7 +423669,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -421128,8 +423720,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -421383,8 +423975,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -421550,7 +424142,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -421830,7 +424422,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -421851,15 +424443,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -422075,8 +424667,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -422090,13 +424682,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -422122,7 +424714,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -422181,7 +424773,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -422280,7 +424872,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -422311,8 +424903,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -422338,7 +424930,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -422381,7 +424977,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -422428,8 +425028,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -422683,8 +425283,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -422850,7 +425450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -423130,7 +425730,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -423151,15 +425751,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -423375,8 +425975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -423390,13 +425990,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -423422,7 +426022,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -423481,7 +426081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -423580,7 +426180,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -423611,8 +426211,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -423638,7 +426238,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -423681,7 +426285,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -423728,8 +426336,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -423983,8 +426591,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -424150,7 +426758,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -424430,7 +427038,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -424451,15 +427059,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -424675,8 +427283,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -424690,13 +427298,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -424722,7 +427330,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -424781,7 +427389,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -424880,7 +427488,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -424911,8 +427519,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -424938,7 +427546,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -424981,7 +427593,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -425028,8 +427644,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -425283,8 +427899,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -425450,7 +428066,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -425730,7 +428346,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -425751,15 +428367,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -425975,8 +428591,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -425990,13 +428606,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -426022,7 +428638,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -426081,7 +428697,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -426180,7 +428796,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -426211,8 +428827,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -426238,7 +428854,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -426281,7 +428901,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -426328,8 +428952,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -426583,8 +429207,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -426750,7 +429374,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -427030,7 +429654,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -427051,15 +429675,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -427275,8 +429899,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -427290,13 +429914,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -427322,7 +429946,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -427381,7 +430005,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -427480,7 +430104,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -427511,8 +430135,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -427538,7 +430162,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -427581,7 +430209,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -427628,8 +430260,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -427883,8 +430515,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -428050,7 +430682,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -428330,7 +430962,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -428351,15 +430983,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -428575,8 +431207,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -428590,13 +431222,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -428622,7 +431254,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -428681,7 +431313,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -428780,7 +431412,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -428811,8 +431443,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -428838,7 +431470,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -428881,7 +431517,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -428928,8 +431568,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -429183,8 +431823,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -429350,7 +431990,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -429630,7 +432270,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -429651,15 +432291,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -429875,8 +432515,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -429890,13 +432530,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -429922,7 +432562,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -429981,7 +432621,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -430080,7 +432720,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -430111,8 +432751,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -430138,7 +432778,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -430181,7 +432825,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -430228,8 +432876,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -430483,8 +433131,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -430650,7 +433298,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -430930,7 +433578,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -430951,15 +433599,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -431175,8 +433823,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -431190,13 +433838,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -431222,7 +433870,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -431281,7 +433929,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -431380,7 +434028,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -431411,8 +434059,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -431438,7 +434086,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -431481,7 +434133,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -431528,8 +434184,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -431783,8 +434439,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -431950,7 +434606,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -432230,7 +434886,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -432251,15 +434907,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -432475,8 +435131,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -432490,13 +435146,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -432522,7 +435178,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -432581,7 +435237,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -432680,7 +435336,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -432711,8 +435367,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -432738,7 +435394,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -432781,7 +435441,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -432828,8 +435492,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -433083,8 +435747,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -433250,7 +435914,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -433530,7 +436194,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -433551,15 +436215,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -433775,8 +436439,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -433790,13 +436454,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -433822,7 +436486,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -433881,7 +436545,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -433980,7 +436644,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -434011,8 +436675,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -434038,7 +436702,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -434081,7 +436749,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -434128,8 +436800,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -434383,8 +437055,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -434550,7 +437222,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -434830,7 +437502,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -434851,15 +437523,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -435075,8 +437747,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -435090,13 +437762,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -435122,7 +437794,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -435181,7 +437853,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -435280,7 +437952,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -435311,8 +437983,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -435338,7 +438010,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -435381,7 +438057,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -435428,8 +438108,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -435683,8 +438363,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -435850,7 +438530,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -436130,7 +438810,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -436151,15 +438831,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -436375,8 +439055,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -436390,13 +439070,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -436422,7 +439102,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -436481,7 +439161,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -436580,7 +439260,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -436611,8 +439291,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -436638,7 +439318,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -436681,7 +439365,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -436728,8 +439416,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -436983,8 +439671,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -437150,7 +439838,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -437430,7 +440118,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -437451,15 +440139,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -437675,8 +440363,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -437690,13 +440378,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -437722,7 +440410,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -437781,7 +440469,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -437880,7 +440568,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -437911,8 +440599,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -437938,7 +440626,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -437981,7 +440673,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -438028,8 +440724,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -438283,8 +440979,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -438450,7 +441146,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -438730,7 +441426,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -438751,15 +441447,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -438975,8 +441671,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -438990,13 +441686,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -439022,7 +441718,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -439081,7 +441777,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -439180,7 +441876,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -439211,8 +441907,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -439238,7 +441934,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -439281,7 +441981,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -439328,8 +442032,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -439583,8 +442287,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -439750,7 +442454,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -440030,7 +442734,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -440051,15 +442755,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -440275,8 +442979,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -440290,13 +442994,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -440322,7 +443026,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -440381,7 +443085,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -440480,7 +443184,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -440511,8 +443215,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -440538,7 +443242,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -440581,7 +443289,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -440628,8 +443340,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -440883,8 +443595,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -441050,7 +443762,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -441330,7 +444042,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -441351,15 +444063,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -441575,8 +444287,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -441590,13 +444302,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -441622,7 +444334,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -441681,7 +444393,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -441780,7 +444492,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -441811,8 +444523,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -441838,7 +444550,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -441881,7 +444597,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -441928,8 +444648,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -442183,8 +444903,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -442350,7 +445070,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -442630,7 +445350,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -442651,15 +445371,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -442875,8 +445595,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -442890,13 +445610,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -442922,7 +445642,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -442981,7 +445701,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -443080,7 +445800,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -443111,8 +445831,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -443138,7 +445858,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -443181,7 +445905,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -443228,8 +445956,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -443483,8 +446211,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -443650,7 +446378,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -443930,7 +446658,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -443951,15 +446679,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -444175,8 +446903,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -444190,13 +446918,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -444222,7 +446950,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -444281,7 +447009,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -444380,7 +447108,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -444411,8 +447139,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -444438,7 +447166,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -444481,7 +447213,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -444528,8 +447264,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -444783,8 +447519,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -444950,7 +447686,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -445230,7 +447966,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -445251,15 +447987,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -445475,8 +448211,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -445490,13 +448226,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -445522,7 +448258,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -445581,7 +448317,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -445680,7 +448416,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -445711,8 +448447,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -445738,7 +448474,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -445781,7 +448521,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -445828,8 +448572,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -446083,8 +448827,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -446250,7 +448994,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -446530,7 +449274,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -446551,15 +449295,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -446775,8 +449519,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -446790,13 +449534,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -446822,7 +449566,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -446881,7 +449625,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -446980,7 +449724,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -447011,8 +449755,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -447038,7 +449782,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -447081,7 +449829,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -447128,8 +449880,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -447383,8 +450135,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -447550,7 +450302,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -447830,7 +450582,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -447851,15 +450603,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -448075,8 +450827,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -448090,13 +450842,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -448122,7 +450874,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -448181,7 +450933,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -448280,7 +451032,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -448311,8 +451063,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -448338,7 +451090,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -448381,7 +451137,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -448428,8 +451188,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -448683,8 +451443,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -448850,7 +451610,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -449130,7 +451890,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -449151,15 +451911,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -449375,8 +452135,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -449390,13 +452150,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -449422,7 +452182,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -449481,7 +452241,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -449580,7 +452340,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -449611,8 +452371,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -449638,7 +452398,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -449681,7 +452445,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -449728,8 +452496,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -449983,8 +452751,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -450150,7 +452918,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -450430,7 +453198,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -450451,15 +453219,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -450675,8 +453443,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -450690,13 +453458,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -450722,7 +453490,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -450781,7 +453549,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -450880,7 +453648,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -450911,8 +453679,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -450938,7 +453706,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -450981,7 +453753,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -451028,8 +453804,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -451283,8 +454059,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -451450,7 +454226,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -451730,7 +454506,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -451751,15 +454527,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -451975,8 +454751,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -451990,13 +454766,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -452022,7 +454798,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -452081,7 +454857,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -452180,7 +454956,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -452211,8 +454987,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -452238,7 +455014,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -452281,7 +455061,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -452328,8 +455112,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -452583,8 +455367,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -452750,7 +455534,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -453030,7 +455814,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -453051,15 +455835,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -453275,8 +456059,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -453290,13 +456074,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -453322,7 +456106,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -453381,7 +456165,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -453480,7 +456264,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -453511,8 +456295,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -453538,7 +456322,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -453581,7 +456369,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -453628,8 +456420,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -453883,8 +456675,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -454050,7 +456842,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -454330,7 +457122,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -454351,15 +457143,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -454575,8 +457367,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -454590,13 +457382,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -454622,7 +457414,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -454681,7 +457473,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -454780,7 +457572,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -454811,8 +457603,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -454838,7 +457630,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -454881,7 +457677,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -454928,8 +457728,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -455183,8 +457983,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -455350,7 +458150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -455630,7 +458430,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -455651,15 +458451,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -455875,8 +458675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -455890,13 +458690,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -455922,7 +458722,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -455981,7 +458781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -456080,7 +458880,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -456111,8 +458911,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -456138,7 +458938,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -456181,7 +458985,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -456228,8 +459036,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -456483,8 +459291,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -456650,7 +459458,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -456930,7 +459738,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -456951,15 +459759,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -457175,8 +459983,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -457190,13 +459998,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -457222,7 +460030,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -457281,7 +460089,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -457380,7 +460188,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -457411,8 +460219,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -457438,7 +460246,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -457481,7 +460293,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -457528,8 +460344,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -457783,8 +460599,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -457950,7 +460766,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -458230,7 +461046,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -458251,15 +461067,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -458475,8 +461291,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -458490,13 +461306,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -458522,7 +461338,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -458581,7 +461397,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -458680,7 +461496,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -458711,8 +461527,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -458738,7 +461554,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -458781,7 +461601,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -458828,8 +461652,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -459083,8 +461907,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -459250,7 +462074,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -459530,7 +462354,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -459551,15 +462375,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -459775,8 +462599,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -459790,13 +462614,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -459822,7 +462646,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -459881,7 +462705,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -459980,7 +462804,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -460011,8 +462835,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -460038,7 +462862,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -460081,7 +462909,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -460128,8 +462960,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -460383,8 +463215,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -460550,7 +463382,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -460830,7 +463662,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -460851,15 +463683,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -461075,8 +463907,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -461090,13 +463922,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -461122,7 +463954,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -461181,7 +464013,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -461280,7 +464112,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -461311,8 +464143,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -461338,7 +464170,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -461381,7 +464217,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -461428,8 +464268,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -461683,8 +464523,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -461850,7 +464690,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -462130,7 +464970,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -462151,15 +464991,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -462375,8 +465215,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -462390,13 +465230,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -462422,7 +465262,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -462481,7 +465321,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -462580,7 +465420,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -462611,8 +465451,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -462638,7 +465478,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -462681,7 +465525,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -462728,8 +465576,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -462983,8 +465831,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -463150,7 +465998,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -463430,7 +466278,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -463451,15 +466299,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -463675,8 +466523,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -463690,13 +466538,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -463722,7 +466570,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -463781,7 +466629,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -463880,7 +466728,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -463911,8 +466759,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -463938,7 +466786,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -463981,7 +466833,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -464028,8 +466884,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -464283,8 +467139,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -464450,7 +467306,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -464730,7 +467586,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -464751,15 +467607,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -464975,8 +467831,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -464990,13 +467846,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -465022,7 +467878,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -465081,7 +467937,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -465180,7 +468036,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -465211,8 +468067,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -465238,7 +468094,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -465281,7 +468141,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -465328,8 +468192,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -465583,8 +468447,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -465750,7 +468614,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -466030,7 +468894,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -466051,15 +468915,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -466275,8 +469139,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -466290,13 +469154,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -466322,7 +469186,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -466381,7 +469245,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -466480,7 +469344,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -466511,8 +469375,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -466538,7 +469402,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -466581,7 +469449,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -466628,8 +469500,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -466883,8 +469755,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -467050,7 +469922,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -467330,7 +470202,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -467351,15 +470223,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -467575,8 +470447,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -467590,13 +470462,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -467622,7 +470494,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -467681,7 +470553,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -467780,7 +470652,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -467811,8 +470683,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -467838,7 +470710,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -467881,7 +470757,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -467928,8 +470808,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -468183,8 +471063,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -468350,7 +471230,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -468630,7 +471510,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -468651,15 +471531,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -468875,8 +471755,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -468890,13 +471770,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -468922,7 +471802,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -468981,7 +471861,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -469080,7 +471960,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -469111,8 +471991,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -469138,7 +472018,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -469181,7 +472065,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -469228,8 +472116,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -469483,8 +472371,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -469650,7 +472538,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -469930,7 +472818,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -469951,15 +472839,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -470175,8 +473063,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -470190,13 +473078,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -470222,7 +473110,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -470281,7 +473169,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -470380,7 +473268,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -470411,8 +473299,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -470438,7 +473326,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -470481,7 +473373,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -470528,8 +473424,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -470783,8 +473679,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -470950,7 +473846,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -471230,7 +474126,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -471251,15 +474147,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -471475,8 +474371,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -471490,13 +474386,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -471522,7 +474418,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -471581,7 +474477,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -471680,7 +474576,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -471711,8 +474607,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -471738,7 +474634,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -471781,7 +474681,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -471828,8 +474732,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -472083,8 +474987,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -472250,7 +475154,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -472530,7 +475434,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -472551,15 +475455,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -472775,8 +475679,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -472790,13 +475694,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -472822,7 +475726,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -472881,7 +475785,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -472980,7 +475884,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -473011,8 +475915,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -473038,7 +475942,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -473081,7 +475989,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -473128,8 +476040,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -473383,8 +476295,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -473550,7 +476462,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -473830,7 +476742,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -473851,15 +476763,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -474075,8 +476987,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -474090,13 +477002,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -474122,7 +477034,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -474181,7 +477093,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -474280,7 +477192,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -474311,8 +477223,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -474338,7 +477250,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -474381,7 +477297,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -474428,8 +477348,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -474683,8 +477603,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -474850,7 +477770,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -475130,7 +478050,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -475151,15 +478071,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -475375,8 +478295,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -475390,13 +478310,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -475422,7 +478342,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -475481,7 +478401,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -475580,7 +478500,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -475611,8 +478531,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -475638,7 +478558,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -475681,7 +478605,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -475728,8 +478656,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -475983,8 +478911,8 @@
         {},
         {
             "techniqueID": "T1489",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {},
         {},
@@ -476150,7 +479078,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 26,
+            "score": 31,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -476430,7 +479358,7 @@
         {},
         {
             "techniqueID": "T1059",
-            "score": 27,
+            "score": 28,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -476451,15 +479379,15 @@
         {},
         {
             "techniqueID": "T1562.007",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_network_acl_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml"
         },
         {},
         {},
         {},
         {
             "techniqueID": "T1070",
-            "score": 10,
+            "score": 11,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -476675,8 +479603,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 19,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 22,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -476690,13 +479618,13 @@
         {},
         {
             "techniqueID": "T1574",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml"
         },
         {
             "techniqueID": "T1027.005",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {},
         {
@@ -476722,7 +479650,7 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml"
         },
         {
@@ -476781,7 +479709,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -476880,7 +479808,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 6,
+            "score": 7,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -476911,8 +479839,8 @@
         {},
         {
             "techniqueID": "T1070.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1189",
@@ -476938,7 +479866,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml"
         },
-        {},
+        {
+            "techniqueID": "T1059.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
+        },
         {},
         {},
         {},
@@ -476981,7 +479913,11 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {},
-        {},
+        {
+            "techniqueID": "T1574.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1105",
             "score": 4,
@@ -477028,8 +479964,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv
index 7032f04db1..0a790ef479 100644
--- a/docs/mitre-map/detections.csv
+++ b/docs/mitre-map/detections.csv
@@ -18353,1837 +18353,2204 @@ T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1192,No,-,37
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml,36
 T1598.003,No,-,37
 T1107,No,-,37
-T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,36
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml,35
+T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml,35
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml,35
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml,35
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml,35
@@ -20559,7 +20926,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20568,7 +20935,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20577,7 +20944,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20586,7 +20953,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20595,7 +20962,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20604,7 +20971,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20613,7 +20980,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20622,7 +20989,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20631,7 +20998,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20640,7 +21007,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20649,7 +21016,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20658,7 +21025,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20667,7 +21034,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20676,7 +21043,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20685,7 +21052,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20694,7 +21061,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20703,7 +21070,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20712,7 +21079,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20721,7 +21088,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20730,7 +21097,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20739,7 +21106,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20748,7 +21115,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20757,7 +21124,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20766,7 +21133,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20775,7 +21142,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20784,7 +21151,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20793,7 +21160,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20802,7 +21169,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20811,7 +21178,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20820,7 +21187,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20829,7 +21196,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20838,7 +21205,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20847,7 +21214,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20856,7 +21223,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20865,7 +21232,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20874,7 +21241,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20883,7 +21250,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20892,7 +21259,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20901,7 +21268,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20910,7 +21277,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20919,7 +21286,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20928,7 +21295,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20937,7 +21304,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20946,7 +21313,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20955,7 +21322,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20964,7 +21331,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20973,7 +21340,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20982,7 +21349,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -20991,7 +21358,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21000,7 +21367,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21009,7 +21376,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21018,7 +21385,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21027,7 +21394,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21036,7 +21403,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21045,7 +21412,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21054,7 +21421,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21063,7 +21430,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21072,7 +21439,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21081,7 +21448,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21090,7 +21457,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21099,7 +21466,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21108,7 +21475,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21117,7 +21484,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21126,7 +21493,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21135,7 +21502,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21144,7 +21511,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21153,7 +21520,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21162,7 +21529,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21171,7 +21538,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21180,7 +21547,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21189,7 +21556,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21198,7 +21565,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21207,7 +21574,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21216,7 +21583,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21225,7 +21592,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21234,7 +21601,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21243,7 +21610,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21252,7 +21619,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21261,7 +21628,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21270,7 +21637,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21279,7 +21646,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21288,7 +21655,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21297,7 +21664,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21306,7 +21673,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21315,7 +21682,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21324,7 +21691,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21333,7 +21700,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21342,7 +21709,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21351,7 +21718,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21360,7 +21727,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21369,7 +21736,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21378,7 +21745,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21387,7 +21754,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21396,7 +21763,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21405,7 +21772,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21414,7 +21781,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21423,7 +21790,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21432,7 +21799,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21441,7 +21808,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21450,7 +21817,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21459,7 +21826,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21468,7 +21835,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21477,7 +21844,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21486,7 +21853,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21495,7 +21862,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21504,7 +21871,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21513,7 +21880,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21522,7 +21889,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21531,7 +21898,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21540,7 +21907,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21549,7 +21916,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21558,7 +21925,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21567,7 +21934,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21576,7 +21943,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21585,7 +21952,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21594,7 +21961,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21603,7 +21970,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21612,7 +21979,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21621,7 +21988,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21630,7 +21997,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21639,7 +22006,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21648,7 +22015,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21657,7 +22024,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21666,7 +22033,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21675,7 +22042,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21684,7 +22051,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21693,7 +22060,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21702,7 +22069,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21711,7 +22078,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21720,7 +22087,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21729,7 +22096,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21738,7 +22105,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21747,7 +22114,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21756,7 +22123,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21765,7 +22132,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21774,7 +22141,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21783,7 +22150,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21792,7 +22159,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21801,7 +22168,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21810,7 +22177,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21819,7 +22186,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21828,7 +22195,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21837,7 +22204,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21846,7 +22213,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21855,7 +22222,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21864,7 +22231,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21873,7 +22240,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21882,7 +22249,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21891,7 +22258,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21900,7 +22267,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21909,7 +22276,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21918,7 +22285,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21927,7 +22294,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21936,7 +22303,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21945,7 +22312,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21954,7 +22321,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21963,7 +22330,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21972,7 +22339,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21981,7 +22348,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21990,7 +22357,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -21999,7 +22366,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22008,7 +22375,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22017,7 +22384,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22026,7 +22393,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22035,7 +22402,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22044,7 +22411,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22053,7 +22420,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22062,7 +22429,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22071,7 +22438,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22080,7 +22447,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22089,7 +22456,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22098,7 +22465,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22107,7 +22474,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22116,7 +22483,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22125,7 +22492,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22134,7 +22501,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22143,7 +22510,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22152,7 +22519,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22161,7 +22528,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22170,7 +22537,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22179,7 +22546,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22188,7 +22555,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22197,7 +22564,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22206,7 +22573,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22215,7 +22582,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22224,7 +22591,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22233,7 +22600,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22242,7 +22609,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22251,7 +22618,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22260,7 +22627,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22269,7 +22636,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22278,7 +22645,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22287,7 +22654,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22296,7 +22663,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22305,7 +22672,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22314,7 +22681,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22323,7 +22690,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22332,7 +22699,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22341,7 +22708,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22350,7 +22717,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22359,7 +22726,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22368,7 +22735,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22377,7 +22744,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22386,7 +22753,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22395,7 +22762,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22404,7 +22771,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22413,7 +22780,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22422,7 +22789,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22431,7 +22798,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22440,7 +22807,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22449,7 +22816,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22458,7 +22825,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22467,7 +22834,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22476,7 +22843,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22485,7 +22852,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22494,7 +22861,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22503,7 +22870,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22512,7 +22879,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22521,7 +22888,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22530,7 +22897,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22539,7 +22906,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22548,7 +22915,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22557,7 +22924,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22566,7 +22933,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22575,7 +22942,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22584,7 +22951,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22593,7 +22960,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22602,7 +22969,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22611,7 +22978,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22620,7 +22987,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22629,7 +22996,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22638,7 +23005,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22647,7 +23014,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22656,7 +23023,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22665,7 +23032,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22674,7 +23041,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22683,7 +23050,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22692,7 +23059,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22701,7 +23068,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22710,7 +23077,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22719,7 +23086,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22728,7 +23095,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22737,7 +23104,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22746,7 +23113,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22755,7 +23122,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22764,7 +23131,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22773,7 +23140,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22782,7 +23149,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22791,7 +23158,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22800,7 +23167,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22809,7 +23176,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22818,7 +23185,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22827,7 +23194,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22836,7 +23203,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22845,7 +23212,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22854,7 +23221,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22863,7 +23230,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22872,7 +23239,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22881,7 +23248,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22890,7 +23257,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22899,7 +23266,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22908,7 +23275,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22917,7 +23284,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22926,7 +23293,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22935,7 +23302,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22944,7 +23311,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22953,7 +23320,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22962,7 +23329,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22971,7 +23338,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22980,7 +23347,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22989,7 +23356,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -22998,7 +23365,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23007,7 +23374,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23016,7 +23383,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23025,7 +23392,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23034,7 +23401,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23043,7 +23410,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23052,7 +23419,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23061,7 +23428,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23070,7 +23437,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23079,7 +23446,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23088,7 +23455,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23097,7 +23464,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23106,7 +23473,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23115,7 +23482,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23124,7 +23491,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23133,7 +23500,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23142,7 +23509,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23151,7 +23518,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23160,7 +23527,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23169,7 +23536,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23178,7 +23545,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23187,7 +23554,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23196,7 +23563,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23205,7 +23572,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23214,7 +23581,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23223,7 +23590,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23232,7 +23599,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23241,7 +23608,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23250,7 +23617,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23259,7 +23626,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23268,7 +23635,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23277,7 +23644,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23286,7 +23653,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23295,7 +23662,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23304,7 +23671,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23313,7 +23680,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23322,7 +23689,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23331,7 +23698,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23340,7 +23707,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23349,7 +23716,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23358,7 +23725,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23367,7 +23734,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23376,7 +23743,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23385,7 +23752,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23394,7 +23761,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23403,7 +23770,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23412,7 +23779,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23421,7 +23788,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23430,7 +23797,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23439,7 +23806,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23448,7 +23815,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23457,7 +23824,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23466,7 +23833,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23475,7 +23842,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23484,7 +23851,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23493,7 +23860,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23502,7 +23869,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23511,7 +23878,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23520,7 +23887,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23529,7 +23896,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23538,7 +23905,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23547,7 +23914,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23556,7 +23923,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23565,7 +23932,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23574,7 +23941,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23583,7 +23950,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23592,7 +23959,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23601,7 +23968,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23610,7 +23977,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23619,7 +23986,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23628,7 +23995,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23637,7 +24004,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23646,7 +24013,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23655,7 +24022,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23664,7 +24031,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23673,7 +24040,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23682,7 +24049,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23691,7 +24058,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23700,7 +24067,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23709,7 +24076,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23718,7 +24085,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23727,7 +24094,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23736,7 +24103,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23745,7 +24112,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23754,7 +24121,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23763,7 +24130,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23772,7 +24139,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23781,7 +24148,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23790,7 +24157,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23799,7 +24166,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23808,7 +24175,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23817,7 +24184,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23826,7 +24193,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23835,7 +24202,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23844,7 +24211,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml,28
@@ -23853,7 +24220,7 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,28
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml,28
 T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
-T1059.005,No,-,35
+T1059.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml,34
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml,10
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml,10
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,10
@@ -67188,7 +67555,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67217,7 +67584,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67246,7 +67613,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67275,7 +67642,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67304,7 +67671,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67333,7 +67700,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67362,7 +67729,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67391,7 +67758,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67420,7 +67787,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67449,7 +67816,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67478,7 +67845,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67507,7 +67874,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67536,7 +67903,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67565,7 +67932,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67594,7 +67961,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67623,7 +67990,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67652,7 +68019,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67681,7 +68048,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67710,7 +68077,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67739,7 +68106,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67768,7 +68135,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67797,7 +68164,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67826,7 +68193,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67855,7 +68222,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67884,7 +68251,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67913,7 +68280,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67942,7 +68309,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -67971,7 +68338,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68000,7 +68367,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68029,7 +68396,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68058,7 +68425,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68087,7 +68454,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68116,7 +68483,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68145,7 +68512,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68174,7 +68541,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68203,7 +68570,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68232,7 +68599,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68261,7 +68628,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68290,7 +68657,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68319,7 +68686,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68348,7 +68715,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68377,7 +68744,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68406,7 +68773,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68435,7 +68802,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68464,7 +68831,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68493,7 +68860,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68522,7 +68889,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68551,7 +68918,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68580,7 +68947,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68609,7 +68976,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68638,7 +69005,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68667,7 +69034,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68696,7 +69063,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68725,7 +69092,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68754,7 +69121,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68783,7 +69150,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68812,7 +69179,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68841,7 +69208,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68870,7 +69237,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68899,7 +69266,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68928,7 +69295,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68957,7 +69324,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -68986,7 +69353,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69015,7 +69382,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69044,7 +69411,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69073,7 +69440,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69102,7 +69469,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69131,7 +69498,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69160,7 +69527,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69189,7 +69556,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69218,7 +69585,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69247,7 +69614,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69276,7 +69643,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69305,7 +69672,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69334,7 +69701,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69363,7 +69730,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69392,7 +69759,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69421,7 +69788,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69450,7 +69817,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69479,7 +69846,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69508,7 +69875,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69537,7 +69904,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69566,7 +69933,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69595,7 +69962,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69624,7 +69991,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69653,7 +70020,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69682,7 +70049,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69711,7 +70078,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69740,7 +70107,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69769,7 +70136,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69798,7 +70165,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69827,7 +70194,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69856,7 +70223,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69885,7 +70252,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69914,7 +70281,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69943,7 +70310,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -69972,7 +70339,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70001,7 +70368,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70030,7 +70397,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70059,7 +70426,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70088,7 +70455,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70117,7 +70484,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70146,7 +70513,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70175,7 +70542,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70204,7 +70571,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70233,7 +70600,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70262,7 +70629,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70291,7 +70658,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70320,7 +70687,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70349,7 +70716,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70378,7 +70745,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70407,7 +70774,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70436,7 +70803,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70465,7 +70832,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70494,7 +70861,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70523,7 +70890,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70552,7 +70919,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70581,7 +70948,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70610,7 +70977,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70639,7 +71006,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70668,7 +71035,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70697,7 +71064,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70726,7 +71093,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70755,7 +71122,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70784,7 +71151,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70813,7 +71180,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70842,7 +71209,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70871,7 +71238,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70900,7 +71267,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70929,7 +71296,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70958,7 +71325,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -70987,7 +71354,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71016,7 +71383,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71045,7 +71412,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71074,7 +71441,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71103,7 +71470,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71132,7 +71499,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71161,7 +71528,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71190,7 +71557,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71219,7 +71586,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71248,7 +71615,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71277,7 +71644,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71306,7 +71673,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71335,7 +71702,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71364,7 +71731,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71393,7 +71760,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71422,7 +71789,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71451,7 +71818,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71480,7 +71847,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71509,7 +71876,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71538,7 +71905,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71567,7 +71934,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71596,7 +71963,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71625,7 +71992,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71654,7 +72021,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71683,7 +72050,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71712,7 +72079,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71741,7 +72108,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71770,7 +72137,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71799,7 +72166,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71828,7 +72195,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71857,7 +72224,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71886,7 +72253,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71915,7 +72282,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71944,7 +72311,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -71973,7 +72340,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72002,7 +72369,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72031,7 +72398,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72060,7 +72427,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72089,7 +72456,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72118,7 +72485,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72147,7 +72514,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72176,7 +72543,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72205,7 +72572,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72234,7 +72601,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72263,7 +72630,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72292,7 +72659,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72321,7 +72688,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72350,7 +72717,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72379,7 +72746,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72408,7 +72775,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72437,7 +72804,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72466,7 +72833,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72495,7 +72862,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72524,7 +72891,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72553,7 +72920,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72582,7 +72949,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72611,7 +72978,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72640,7 +73007,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72669,7 +73036,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72698,7 +73065,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72727,7 +73094,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72756,7 +73123,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72785,7 +73152,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72814,7 +73181,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72843,7 +73210,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72872,7 +73239,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72901,7 +73268,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72930,7 +73297,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72959,7 +73326,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -72988,7 +73355,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73017,7 +73384,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73046,7 +73413,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73075,7 +73442,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73104,7 +73471,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73133,7 +73500,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73162,7 +73529,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73191,7 +73558,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73220,7 +73587,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73249,7 +73616,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73278,7 +73645,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73307,7 +73674,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73336,7 +73703,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73365,7 +73732,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73394,7 +73761,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73423,7 +73790,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73452,7 +73819,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73481,7 +73848,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73510,7 +73877,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73539,7 +73906,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73568,7 +73935,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73597,7 +73964,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73626,7 +73993,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73655,7 +74022,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73684,7 +74051,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73713,7 +74080,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73742,7 +74109,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73771,7 +74138,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73800,7 +74167,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73829,7 +74196,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73858,7 +74225,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73887,7 +74254,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73916,7 +74283,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73945,7 +74312,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -73974,7 +74341,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74003,7 +74370,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74032,7 +74399,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74061,7 +74428,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74090,7 +74457,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74119,7 +74486,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74148,7 +74515,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74177,7 +74544,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74206,7 +74573,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74235,7 +74602,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74264,7 +74631,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74293,7 +74660,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74322,7 +74689,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74351,7 +74718,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74380,7 +74747,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74409,7 +74776,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74438,7 +74805,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74467,7 +74834,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74496,7 +74863,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74525,7 +74892,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74554,7 +74921,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74583,7 +74950,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74612,7 +74979,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74641,7 +75008,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74670,7 +75037,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74699,7 +75066,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74728,7 +75095,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74757,7 +75124,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74786,7 +75153,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74815,7 +75182,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74844,7 +75211,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74873,7 +75240,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74902,7 +75269,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74931,7 +75298,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74960,7 +75327,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -74989,7 +75356,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75018,7 +75385,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75047,7 +75414,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75076,7 +75443,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75105,7 +75472,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75134,7 +75501,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75163,7 +75530,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75192,7 +75559,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75221,7 +75588,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75250,7 +75617,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75279,7 +75646,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75308,7 +75675,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75337,7 +75704,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75366,7 +75733,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75395,7 +75762,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75424,7 +75791,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75453,7 +75820,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75482,7 +75849,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75511,7 +75878,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75540,7 +75907,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75569,7 +75936,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75598,7 +75965,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75627,7 +75994,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75656,7 +76023,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75685,7 +76052,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75714,7 +76081,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75743,7 +76110,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75772,7 +76139,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75801,7 +76168,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75830,7 +76197,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75859,7 +76226,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75888,7 +76255,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75917,7 +76284,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75946,7 +76313,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -75975,7 +76342,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76004,7 +76371,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76033,7 +76400,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76062,7 +76429,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76091,7 +76458,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76120,7 +76487,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76149,7 +76516,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76178,7 +76545,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76207,7 +76574,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76236,7 +76603,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76265,7 +76632,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76294,7 +76661,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76323,7 +76690,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76352,7 +76719,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76381,7 +76748,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76410,7 +76777,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76439,7 +76806,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76468,7 +76835,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76497,7 +76864,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76526,7 +76893,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76555,7 +76922,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76584,7 +76951,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76613,7 +76980,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76642,7 +77009,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76671,7 +77038,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76700,7 +77067,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76729,7 +77096,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76758,7 +77125,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76787,7 +77154,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76816,7 +77183,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76845,7 +77212,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76874,7 +77241,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76903,7 +77270,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76932,7 +77299,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76961,7 +77328,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -76990,7 +77357,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77019,7 +77386,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77048,7 +77415,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77077,7 +77444,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77106,7 +77473,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77135,7 +77502,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77164,7 +77531,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77193,7 +77560,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77222,7 +77589,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77251,7 +77618,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77280,7 +77647,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77309,7 +77676,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77338,7 +77705,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77367,7 +77734,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77396,7 +77763,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77425,7 +77792,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77454,7 +77821,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77483,7 +77850,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77512,7 +77879,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77541,7 +77908,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77570,7 +77937,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77599,7 +77966,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77628,7 +77995,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77657,7 +78024,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77686,7 +78053,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77715,7 +78082,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77744,7 +78111,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77773,7 +78140,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml,7
@@ -77802,7 +78169,7 @@ T1073,No,-,16
 T1100,No,-,16
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
-T1574.002,No,-,16
+T1574.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml,15
 T1063,No,-,15
 T1119,No,-,15
 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml,14
@@ -81476,8443 +81843,9544 @@ T1584.001,No,-,15
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-8
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-8
 T1027.002,No,-,14
 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
@@ -91770,9 +93238,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91795,9 +93264,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91820,9 +93290,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91845,9 +93316,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91870,9 +93342,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91895,9 +93368,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91920,9 +93394,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91945,9 +93420,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91970,9 +93446,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -91995,9 +93472,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92020,9 +93498,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92045,9 +93524,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92070,9 +93550,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92095,9 +93576,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92120,9 +93602,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92145,9 +93628,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92170,9 +93654,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92195,9 +93680,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92220,9 +93706,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92245,9 +93732,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92270,9 +93758,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92295,9 +93784,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92320,9 +93810,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92345,9 +93836,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92370,9 +93862,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92395,9 +93888,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92420,9 +93914,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92445,9 +93940,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92470,9 +93966,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92495,9 +93992,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92520,9 +94018,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92545,9 +94044,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92570,9 +94070,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92595,9 +94096,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92620,9 +94122,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92645,9 +94148,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92670,9 +94174,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92695,9 +94200,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92720,9 +94226,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92745,9 +94252,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92770,9 +94278,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92795,9 +94304,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92820,9 +94330,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92845,9 +94356,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92870,9 +94382,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92895,9 +94408,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92920,9 +94434,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92945,9 +94460,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92970,9 +94486,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -92995,9 +94512,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93020,9 +94538,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93045,9 +94564,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93070,9 +94590,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93095,9 +94616,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93120,9 +94642,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93145,9 +94668,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93170,9 +94694,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93195,9 +94720,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93220,9 +94746,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93245,9 +94772,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93270,9 +94798,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93295,9 +94824,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93320,9 +94850,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93345,9 +94876,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93370,9 +94902,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93395,9 +94928,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93420,9 +94954,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93445,9 +94980,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93470,9 +95006,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93495,9 +95032,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93520,9 +95058,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93545,9 +95084,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93570,9 +95110,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93595,9 +95136,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93620,9 +95162,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93645,9 +95188,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93670,9 +95214,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93695,9 +95240,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93720,9 +95266,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93745,9 +95292,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93770,9 +95318,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93795,9 +95344,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93820,9 +95370,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93845,9 +95396,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93870,9 +95422,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93895,9 +95448,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93920,9 +95474,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93945,9 +95500,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93970,9 +95526,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -93995,9 +95552,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94020,9 +95578,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94045,9 +95604,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94070,9 +95630,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94095,9 +95656,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94120,9 +95682,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94145,9 +95708,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94170,9 +95734,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94195,9 +95760,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94220,9 +95786,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94245,9 +95812,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94270,9 +95838,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94295,9 +95864,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94320,9 +95890,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94345,9 +95916,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94370,9 +95942,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94395,9 +95968,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94420,9 +95994,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94445,9 +96020,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94470,9 +96046,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94495,9 +96072,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94520,9 +96098,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94545,9 +96124,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94570,9 +96150,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94595,9 +96176,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94620,9 +96202,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94645,9 +96228,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94670,9 +96254,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94695,9 +96280,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94720,9 +96306,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94745,9 +96332,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94770,9 +96358,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94795,9 +96384,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94820,9 +96410,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94845,9 +96436,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94870,9 +96462,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94895,9 +96488,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94920,9 +96514,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94945,9 +96540,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94970,9 +96566,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -94995,9 +96592,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95020,9 +96618,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95045,9 +96644,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95070,9 +96670,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95095,9 +96696,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95120,9 +96722,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95145,9 +96748,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95170,9 +96774,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95195,9 +96800,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95220,9 +96826,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95245,9 +96852,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95270,9 +96878,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95295,9 +96904,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95320,9 +96930,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95345,9 +96956,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95370,9 +96982,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95395,9 +97008,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95420,9 +97034,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95445,9 +97060,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95470,9 +97086,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95495,9 +97112,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95520,9 +97138,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95545,9 +97164,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95570,9 +97190,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95595,9 +97216,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95620,9 +97242,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95645,9 +97268,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95670,9 +97294,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95695,9 +97320,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95720,9 +97346,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95745,9 +97372,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95770,9 +97398,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95795,9 +97424,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95820,9 +97450,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95845,9 +97476,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95870,9 +97502,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95895,9 +97528,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95920,9 +97554,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95945,9 +97580,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95970,9 +97606,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -95995,9 +97632,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96020,9 +97658,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96045,9 +97684,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96070,9 +97710,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96095,9 +97736,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96120,9 +97762,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96145,9 +97788,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96170,9 +97814,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96195,9 +97840,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96220,9 +97866,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96245,9 +97892,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96270,9 +97918,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96295,9 +97944,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96320,9 +97970,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96345,9 +97996,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96370,9 +98022,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96395,9 +98048,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96420,9 +98074,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96445,9 +98100,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96470,9 +98126,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96495,9 +98152,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96520,9 +98178,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96545,9 +98204,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96570,9 +98230,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96595,9 +98256,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96620,9 +98282,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96645,9 +98308,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96670,9 +98334,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96695,9 +98360,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96720,9 +98386,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96745,9 +98412,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96770,9 +98438,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96795,9 +98464,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96820,9 +98490,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96845,9 +98516,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96870,9 +98542,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96895,9 +98568,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96920,9 +98594,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96945,9 +98620,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96970,9 +98646,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -96995,9 +98672,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97020,9 +98698,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97045,9 +98724,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97070,9 +98750,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97095,9 +98776,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97120,9 +98802,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97145,9 +98828,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97170,9 +98854,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97195,9 +98880,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97220,9 +98906,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97245,9 +98932,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97270,9 +98958,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97295,9 +98984,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97320,9 +99010,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97345,9 +99036,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97370,9 +99062,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97395,9 +99088,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97420,9 +99114,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97445,9 +99140,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97470,9 +99166,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97495,9 +99192,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97520,9 +99218,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97545,9 +99244,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97570,9 +99270,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97595,9 +99296,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97620,9 +99322,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97645,9 +99348,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97670,9 +99374,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97695,9 +99400,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97720,9 +99426,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97745,9 +99452,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97770,9 +99478,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97795,9 +99504,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97820,9 +99530,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97845,9 +99556,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97870,9 +99582,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97895,9 +99608,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97920,9 +99634,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97945,9 +99660,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97970,9 +99686,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -97995,9 +99712,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98020,9 +99738,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98045,9 +99764,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98070,9 +99790,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98095,9 +99816,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98120,9 +99842,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98145,9 +99868,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98170,9 +99894,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98195,9 +99920,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98220,9 +99946,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98245,9 +99972,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98270,9 +99998,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98295,9 +100024,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98320,9 +100050,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98345,9 +100076,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98370,9 +100102,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98395,9 +100128,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98420,9 +100154,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98445,9 +100180,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98470,9 +100206,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98495,9 +100232,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98520,9 +100258,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98545,9 +100284,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98570,9 +100310,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98595,9 +100336,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98620,9 +100362,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98645,9 +100388,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98670,9 +100414,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98695,9 +100440,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98720,9 +100466,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98745,9 +100492,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98770,9 +100518,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98795,9 +100544,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98820,9 +100570,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98845,9 +100596,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98870,9 +100622,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98895,9 +100648,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98920,9 +100674,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98945,9 +100700,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98970,9 +100726,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -98995,9 +100752,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99020,9 +100778,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99045,9 +100804,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99070,9 +100830,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99095,9 +100856,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99120,9 +100882,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99145,9 +100908,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99170,9 +100934,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99195,9 +100960,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99220,9 +100986,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99245,9 +101012,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99270,9 +101038,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99295,9 +101064,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99320,9 +101090,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99345,9 +101116,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99370,9 +101142,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99395,9 +101168,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99420,9 +101194,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99445,9 +101220,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99470,9 +101246,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99495,9 +101272,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99520,9 +101298,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99545,9 +101324,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99570,9 +101350,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99595,9 +101376,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99620,9 +101402,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99645,9 +101428,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99670,9 +101454,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99695,9 +101480,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99720,9 +101506,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99745,9 +101532,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99770,9 +101558,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99795,9 +101584,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99820,9 +101610,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99845,9 +101636,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99870,9 +101662,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99895,9 +101688,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99920,9 +101714,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99945,9 +101740,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99970,9 +101766,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -99995,9 +101792,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100020,9 +101818,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100045,9 +101844,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100070,9 +101870,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100095,9 +101896,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100120,9 +101922,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100145,9 +101948,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100170,9 +101974,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100195,9 +102000,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100220,9 +102026,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100245,9 +102052,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100270,9 +102078,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100295,9 +102104,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100320,9 +102130,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100345,9 +102156,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100370,9 +102182,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100395,9 +102208,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100420,9 +102234,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100445,9 +102260,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100470,9 +102286,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100495,9 +102312,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100520,9 +102338,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100545,9 +102364,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100570,9 +102390,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100595,9 +102416,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100620,9 +102442,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100645,9 +102468,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100670,9 +102494,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100695,9 +102520,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100720,9 +102546,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100745,9 +102572,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100770,9 +102598,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100795,9 +102624,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100820,9 +102650,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100845,9 +102676,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100870,9 +102702,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100895,9 +102728,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -100920,9 +102754,10 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml,7
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,7
 T1035,No,-,11
 T1143,No,-,10
 T1132.001,No,-,10
@@ -117451,7 +119286,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117479,7 +119315,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117507,7 +119344,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117535,7 +119373,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117563,7 +119402,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117591,7 +119431,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117619,7 +119460,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117647,7 +119489,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117675,7 +119518,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117703,7 +119547,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117731,7 +119576,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117759,7 +119605,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117787,7 +119634,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117815,7 +119663,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117843,7 +119692,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117871,7 +119721,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117899,7 +119750,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117927,7 +119779,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117955,7 +119808,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -117983,7 +119837,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118011,7 +119866,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118039,7 +119895,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118067,7 +119924,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118095,7 +119953,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118123,7 +119982,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118151,7 +120011,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118179,7 +120040,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118207,7 +120069,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118235,7 +120098,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118263,7 +120127,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118291,7 +120156,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118319,7 +120185,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118347,7 +120214,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118375,7 +120243,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118403,7 +120272,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118431,7 +120301,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118459,7 +120330,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118487,7 +120359,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118515,7 +120388,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118543,7 +120417,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118571,7 +120446,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118599,7 +120475,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118627,7 +120504,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118655,7 +120533,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118683,7 +120562,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118711,7 +120591,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118739,7 +120620,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118767,7 +120649,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118795,7 +120678,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118823,7 +120707,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118851,7 +120736,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118879,7 +120765,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118907,7 +120794,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118935,7 +120823,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118963,7 +120852,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -118991,7 +120881,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119019,7 +120910,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119047,7 +120939,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119075,7 +120968,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119103,7 +120997,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119131,7 +121026,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119159,7 +121055,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119187,7 +121084,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119215,7 +121113,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119243,7 +121142,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119271,7 +121171,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119299,7 +121200,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119327,7 +121229,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119355,7 +121258,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119383,7 +121287,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119411,7 +121316,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119439,7 +121345,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119467,7 +121374,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119495,7 +121403,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119523,7 +121432,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119551,7 +121461,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119579,7 +121490,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119607,7 +121519,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119635,7 +121548,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119663,7 +121577,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119691,7 +121606,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119719,7 +121635,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119747,7 +121664,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119775,7 +121693,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119803,7 +121722,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119831,7 +121751,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119859,7 +121780,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119887,7 +121809,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119915,7 +121838,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119943,7 +121867,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119971,7 +121896,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -119999,7 +121925,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120027,7 +121954,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120055,7 +121983,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120083,7 +122012,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120111,7 +122041,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120139,7 +122070,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120167,7 +122099,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120195,7 +122128,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120223,7 +122157,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120251,7 +122186,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120279,7 +122215,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120307,7 +122244,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120335,7 +122273,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120363,7 +122302,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120391,7 +122331,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120419,7 +122360,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120447,7 +122389,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120475,7 +122418,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120503,7 +122447,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120531,7 +122476,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120559,7 +122505,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120587,7 +122534,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120615,7 +122563,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120643,7 +122592,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120671,7 +122621,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120699,7 +122650,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120727,7 +122679,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120755,7 +122708,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120783,7 +122737,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120811,7 +122766,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120839,7 +122795,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120867,7 +122824,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120895,7 +122853,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120923,7 +122882,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120951,7 +122911,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -120979,7 +122940,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121007,7 +122969,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121035,7 +122998,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121063,7 +123027,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121091,7 +123056,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121119,7 +123085,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121147,7 +123114,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121175,7 +123143,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121203,7 +123172,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121231,7 +123201,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121259,7 +123230,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121287,7 +123259,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121315,7 +123288,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121343,7 +123317,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121371,7 +123346,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121399,7 +123375,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121427,7 +123404,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121455,7 +123433,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121483,7 +123462,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121511,7 +123491,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121539,7 +123520,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121567,7 +123549,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121595,7 +123578,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121623,7 +123607,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121651,7 +123636,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121679,7 +123665,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121707,7 +123694,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121735,7 +123723,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121763,7 +123752,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121791,7 +123781,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121819,7 +123810,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121847,7 +123839,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121875,7 +123868,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121903,7 +123897,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121931,7 +123926,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121959,7 +123955,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -121987,7 +123984,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122015,7 +124013,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122043,7 +124042,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122071,7 +124071,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122099,7 +124100,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122127,7 +124129,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122155,7 +124158,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122183,7 +124187,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122211,7 +124216,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122239,7 +124245,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122267,7 +124274,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122295,7 +124303,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122323,7 +124332,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122351,7 +124361,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122379,7 +124390,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122407,7 +124419,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122435,7 +124448,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122463,7 +124477,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122491,7 +124506,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122519,7 +124535,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122547,7 +124564,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122575,7 +124593,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122603,7 +124622,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122631,7 +124651,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122659,7 +124680,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122687,7 +124709,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122715,7 +124738,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122743,7 +124767,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122771,7 +124796,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122799,7 +124825,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122827,7 +124854,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122855,7 +124883,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122883,7 +124912,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122911,7 +124941,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122939,7 +124970,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122967,7 +124999,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -122995,7 +125028,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123023,7 +125057,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123051,7 +125086,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123079,7 +125115,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123107,7 +125144,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123135,7 +125173,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123163,7 +125202,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123191,7 +125231,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123219,7 +125260,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123247,7 +125289,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123275,7 +125318,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123303,7 +125347,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123331,7 +125376,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123359,7 +125405,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123387,7 +125434,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123415,7 +125463,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123443,7 +125492,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123471,7 +125521,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123499,7 +125550,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123527,7 +125579,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123555,7 +125608,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123583,7 +125637,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123611,7 +125666,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123639,7 +125695,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123667,7 +125724,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123695,7 +125753,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123723,7 +125782,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123751,7 +125811,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123779,7 +125840,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123807,7 +125869,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123835,7 +125898,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123863,7 +125927,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123891,7 +125956,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123919,7 +125985,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123947,7 +126014,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -123975,7 +126043,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124003,7 +126072,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124031,7 +126101,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124059,7 +126130,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124087,7 +126159,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124115,7 +126188,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124143,7 +126217,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124171,7 +126246,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124199,7 +126275,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124227,7 +126304,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124255,7 +126333,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124283,7 +126362,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124311,7 +126391,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124339,7 +126420,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124367,7 +126449,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124395,7 +126478,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124423,7 +126507,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124451,7 +126536,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124479,7 +126565,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124507,7 +126594,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124535,7 +126623,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124563,7 +126652,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124591,7 +126681,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124619,7 +126710,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124647,7 +126739,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124675,7 +126768,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124703,7 +126797,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124731,7 +126826,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124759,7 +126855,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124787,7 +126884,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124815,7 +126913,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124843,7 +126942,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124871,7 +126971,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124899,7 +127000,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124927,7 +127029,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124955,7 +127058,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -124983,7 +127087,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125011,7 +127116,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125039,7 +127145,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125067,7 +127174,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125095,7 +127203,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125123,7 +127232,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125151,7 +127261,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125179,7 +127290,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125207,7 +127319,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125235,7 +127348,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125263,7 +127377,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125291,7 +127406,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125319,7 +127435,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125347,7 +127464,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125375,7 +127493,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125403,7 +127522,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125431,7 +127551,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125459,7 +127580,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125487,7 +127609,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125515,7 +127638,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125543,7 +127667,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125571,7 +127696,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125599,7 +127725,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125627,7 +127754,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125655,7 +127783,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125683,7 +127812,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125711,7 +127841,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125739,7 +127870,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125767,7 +127899,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125795,7 +127928,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125823,7 +127957,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125851,7 +127986,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125879,7 +128015,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125907,7 +128044,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125935,7 +128073,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125963,7 +128102,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -125991,7 +128131,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126019,7 +128160,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126047,7 +128189,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126075,7 +128218,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126103,7 +128247,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126131,7 +128276,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126159,7 +128305,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126187,7 +128334,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126215,7 +128363,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126243,7 +128392,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126271,7 +128421,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126299,7 +128450,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126327,7 +128479,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126355,7 +128508,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126383,7 +128537,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126411,7 +128566,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126439,7 +128595,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126467,7 +128624,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126495,7 +128653,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126523,7 +128682,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126551,7 +128711,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126579,7 +128740,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126607,7 +128769,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126635,7 +128798,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126663,7 +128827,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126691,7 +128856,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126719,7 +128885,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126747,7 +128914,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126775,7 +128943,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126803,7 +128972,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126831,7 +129001,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126859,7 +129030,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126887,7 +129059,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126915,7 +129088,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126943,7 +129117,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126971,7 +129146,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -126999,7 +129175,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127027,7 +129204,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127055,7 +129233,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127083,7 +129262,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127111,7 +129291,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127139,7 +129320,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127167,7 +129349,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127195,7 +129378,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127223,7 +129407,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127251,7 +129436,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127279,7 +129465,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127307,7 +129494,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127335,7 +129523,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127363,7 +129552,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127391,7 +129581,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127419,7 +129610,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127447,7 +129639,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127475,7 +129668,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127503,7 +129697,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127531,7 +129726,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127559,7 +129755,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127587,7 +129784,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127615,7 +129813,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127643,7 +129842,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127671,7 +129871,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -127699,7 +129900,8 @@ T1027.001,No,-,8
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
 T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml,6
 T1552.001,No,-,8
-T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,7
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml,6
+T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml,6
 T1065,No,-,8
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
 T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
@@ -183903,8 +186105,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183957,8 +186159,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184011,8 +186213,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184065,8 +186267,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184119,8 +186321,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184173,8 +186375,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184227,8 +186429,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184281,8 +186483,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184335,8 +186537,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184389,8 +186591,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184443,8 +186645,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184497,8 +186699,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184551,8 +186753,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184605,8 +186807,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184659,8 +186861,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184713,8 +186915,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184767,8 +186969,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184821,8 +187023,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184875,8 +187077,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184929,8 +187131,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184983,8 +187185,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185037,8 +187239,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185091,8 +187293,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185145,8 +187347,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185199,8 +187401,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185253,8 +187455,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185307,8 +187509,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185361,8 +187563,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185415,8 +187617,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185469,8 +187671,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185523,8 +187725,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185577,8 +187779,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185631,8 +187833,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185685,8 +187887,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185739,8 +187941,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185793,8 +187995,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185847,8 +188049,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185901,8 +188103,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185955,8 +188157,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186009,8 +188211,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186063,8 +188265,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186117,8 +188319,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186171,8 +188373,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186225,8 +188427,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186279,8 +188481,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186333,8 +188535,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186387,8 +188589,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186441,8 +188643,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186495,8 +188697,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186549,8 +188751,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186603,8 +188805,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186657,8 +188859,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186711,8 +188913,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186765,8 +188967,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186819,8 +189021,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186873,8 +189075,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186927,8 +189129,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186981,8 +189183,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187035,8 +189237,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187089,8 +189291,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187143,8 +189345,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187197,8 +189399,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187251,8 +189453,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187305,8 +189507,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187359,8 +189561,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187413,8 +189615,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187467,8 +189669,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187521,8 +189723,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187575,8 +189777,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187629,8 +189831,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187683,8 +189885,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187737,8 +189939,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187791,8 +189993,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187845,8 +190047,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187899,8 +190101,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187953,8 +190155,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188007,8 +190209,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188061,8 +190263,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188115,8 +190317,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188169,8 +190371,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188223,8 +190425,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188277,8 +190479,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188331,8 +190533,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188385,8 +190587,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188439,8 +190641,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188493,8 +190695,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188547,8 +190749,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188601,8 +190803,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188655,8 +190857,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188709,8 +190911,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188763,8 +190965,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188817,8 +191019,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188871,8 +191073,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188925,8 +191127,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188979,8 +191181,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189033,8 +191235,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189087,8 +191289,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189141,8 +191343,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189195,8 +191397,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189249,8 +191451,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189303,8 +191505,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189357,8 +191559,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189411,8 +191613,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189465,8 +191667,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189519,8 +191721,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189573,8 +191775,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189627,8 +191829,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189681,8 +191883,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189735,8 +191937,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189789,8 +191991,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189843,8 +192045,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189897,8 +192099,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189951,8 +192153,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190005,8 +192207,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190059,8 +192261,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190113,8 +192315,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190167,8 +192369,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190221,8 +192423,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190275,8 +192477,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190329,8 +192531,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190383,8 +192585,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190437,8 +192639,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190491,8 +192693,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190545,8 +192747,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190599,8 +192801,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190653,8 +192855,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190707,8 +192909,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190761,8 +192963,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190815,8 +193017,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190869,8 +193071,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190923,8 +193125,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190977,8 +193179,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191031,8 +193233,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191085,8 +193287,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191139,8 +193341,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191193,8 +193395,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191247,8 +193449,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191301,8 +193503,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191355,8 +193557,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191409,8 +193611,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191463,8 +193665,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191517,8 +193719,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191571,8 +193773,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191625,8 +193827,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191679,8 +193881,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191733,8 +193935,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191787,8 +193989,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191841,8 +194043,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191895,8 +194097,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191949,8 +194151,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192003,8 +194205,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192057,8 +194259,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192111,8 +194313,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192165,8 +194367,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192219,8 +194421,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192273,8 +194475,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192327,8 +194529,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192381,8 +194583,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192435,8 +194637,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192489,8 +194691,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192543,8 +194745,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192597,8 +194799,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192651,8 +194853,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192705,8 +194907,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192759,8 +194961,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192813,8 +195015,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192867,8 +195069,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192921,8 +195123,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192975,8 +195177,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193029,8 +195231,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193083,8 +195285,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193137,8 +195339,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193191,8 +195393,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193245,8 +195447,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193299,8 +195501,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193353,8 +195555,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193407,8 +195609,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193461,8 +195663,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193515,8 +195717,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193569,8 +195771,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193623,8 +195825,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193677,8 +195879,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193731,8 +195933,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193785,8 +195987,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193839,8 +196041,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193893,8 +196095,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193947,8 +196149,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194001,8 +196203,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194055,8 +196257,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194109,8 +196311,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194163,8 +196365,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194217,8 +196419,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194271,8 +196473,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194325,8 +196527,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194379,8 +196581,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194433,8 +196635,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194487,8 +196689,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194541,8 +196743,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194595,8 +196797,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194649,8 +196851,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194703,8 +196905,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194757,8 +196959,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194811,8 +197013,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194865,8 +197067,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194919,8 +197121,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194973,8 +197175,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195027,8 +197229,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195081,8 +197283,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195135,8 +197337,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195189,8 +197391,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195243,8 +197445,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195297,8 +197499,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195351,8 +197553,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195405,8 +197607,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195459,8 +197661,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195513,8 +197715,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195567,8 +197769,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195621,8 +197823,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195675,8 +197877,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195729,8 +197931,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195783,8 +197985,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195837,8 +198039,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195891,8 +198093,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195945,8 +198147,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195999,8 +198201,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196053,8 +198255,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196107,8 +198309,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196161,8 +198363,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196215,8 +198417,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196269,8 +198471,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196323,8 +198525,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196377,8 +198579,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196431,8 +198633,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196485,8 +198687,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196539,8 +198741,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196593,8 +198795,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196647,8 +198849,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196701,8 +198903,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196755,8 +198957,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196809,8 +199011,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196863,8 +199065,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196917,8 +199119,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196971,8 +199173,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197025,8 +199227,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197079,8 +199281,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197133,8 +199335,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197187,8 +199389,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197241,8 +199443,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197295,8 +199497,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197349,8 +199551,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197403,8 +199605,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197457,8 +199659,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197511,8 +199713,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197565,8 +199767,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197619,8 +199821,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197673,8 +199875,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197727,8 +199929,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197781,8 +199983,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197835,8 +200037,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197889,8 +200091,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197943,8 +200145,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197997,8 +200199,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198051,8 +200253,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198105,8 +200307,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198159,8 +200361,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198213,8 +200415,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198267,8 +200469,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198321,8 +200523,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198375,8 +200577,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198429,8 +200631,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198483,8 +200685,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198537,8 +200739,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198591,8 +200793,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198645,8 +200847,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198699,8 +200901,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198753,8 +200955,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198807,8 +201009,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198861,8 +201063,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198915,8 +201117,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198969,8 +201171,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199023,8 +201225,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199077,8 +201279,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199131,8 +201333,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199185,8 +201387,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199239,8 +201441,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199293,8 +201495,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199347,8 +201549,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199401,8 +201603,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199455,8 +201657,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199509,8 +201711,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199563,8 +201765,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199617,8 +201819,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199671,8 +201873,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199725,8 +201927,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199779,8 +201981,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199833,8 +202035,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199887,8 +202089,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199941,8 +202143,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199995,8 +202197,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200049,8 +202251,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200103,8 +202305,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200157,8 +202359,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200211,8 +202413,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200265,8 +202467,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200319,8 +202521,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200373,8 +202575,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200427,8 +202629,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200481,8 +202683,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200535,8 +202737,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200589,8 +202791,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200643,8 +202845,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200697,8 +202899,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200751,8 +202953,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200805,8 +203007,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200859,8 +203061,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200913,8 +203115,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200967,8 +203169,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201021,8 +203223,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201075,8 +203277,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201129,8 +203331,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201183,8 +203385,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201237,8 +203439,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201291,8 +203493,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201345,8 +203547,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201399,8 +203601,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201453,8 +203655,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201507,8 +203709,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201561,8 +203763,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201615,8 +203817,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201669,8 +203871,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201723,8 +203925,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201777,8 +203979,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201831,8 +204033,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201885,8 +204087,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201939,8 +204141,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201993,8 +204195,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202047,8 +204249,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202101,8 +204303,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202155,8 +204357,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202209,8 +204411,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202263,8 +204465,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202317,8 +204519,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202371,8 +204573,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202425,8 +204627,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202479,8 +204681,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202533,8 +204735,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202587,8 +204789,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202641,8 +204843,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202695,8 +204897,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202749,8 +204951,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202803,8 +205005,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202857,8 +205059,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202911,8 +205113,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202965,8 +205167,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203019,8 +205221,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203073,8 +205275,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203127,8 +205329,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203181,8 +205383,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203235,8 +205437,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203289,8 +205491,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203343,8 +205545,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203397,8 +205599,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203451,8 +205653,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203505,8 +205707,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203559,8 +205761,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203613,8 +205815,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203667,8 +205869,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -203692,9 +205894,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -203744,9 +205951,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -203796,9 +206008,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -203848,9 +206065,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -203900,9 +206122,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -203952,9 +206179,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204004,9 +206236,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204056,9 +206293,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204108,9 +206350,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204160,9 +206407,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204212,9 +206464,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204264,9 +206521,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204316,9 +206578,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204368,9 +206635,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204420,9 +206692,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204472,9 +206749,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204524,9 +206806,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204576,9 +206863,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204628,9 +206920,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204680,9 +206977,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204732,9 +207034,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204784,9 +207091,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204836,9 +207148,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204888,9 +207205,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204940,9 +207262,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -204992,9 +207319,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205044,9 +207376,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205096,9 +207433,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205148,9 +207490,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205200,9 +207547,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205252,9 +207604,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205304,9 +207661,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205356,9 +207718,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205408,9 +207775,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205460,9 +207832,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205512,9 +207889,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205564,9 +207946,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205616,9 +208003,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205668,9 +208060,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205720,9 +208117,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205772,9 +208174,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205824,9 +208231,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205876,9 +208288,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205928,9 +208345,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -205980,9 +208402,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206032,9 +208459,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206084,9 +208516,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206136,9 +208573,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206188,9 +208630,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206240,9 +208687,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206292,9 +208744,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206344,9 +208801,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206396,9 +208858,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206448,9 +208915,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206500,9 +208972,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206552,9 +209029,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206604,9 +209086,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206656,9 +209143,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206708,9 +209200,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206760,9 +209257,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206812,9 +209314,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206864,9 +209371,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206916,9 +209428,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -206968,9 +209485,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207020,9 +209542,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207072,9 +209599,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207124,9 +209656,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207176,9 +209713,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207228,9 +209770,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207280,9 +209827,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207332,9 +209884,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207384,9 +209941,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207436,9 +209998,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207488,9 +210055,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207540,9 +210112,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207592,9 +210169,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207644,9 +210226,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207696,9 +210283,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207748,9 +210340,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207800,9 +210397,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207852,9 +210454,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207904,9 +210511,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -207956,9 +210568,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208008,9 +210625,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208060,9 +210682,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208112,9 +210739,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208164,9 +210796,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208216,9 +210853,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208268,9 +210910,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208320,9 +210967,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208372,9 +211024,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208424,9 +211081,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208476,9 +211138,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208528,9 +211195,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208580,9 +211252,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208632,9 +211309,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208684,9 +211366,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208736,9 +211423,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208788,9 +211480,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208840,9 +211537,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208892,9 +211594,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208944,9 +211651,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -208996,9 +211708,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209048,9 +211765,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209100,9 +211822,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209152,9 +211879,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209204,9 +211936,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209256,9 +211993,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209308,9 +212050,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209360,9 +212107,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209412,9 +212164,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209464,9 +212221,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209516,9 +212278,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209568,9 +212335,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209620,9 +212392,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209672,9 +212449,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209724,9 +212506,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209776,9 +212563,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209828,9 +212620,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209880,9 +212677,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209932,9 +212734,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -209984,9 +212791,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210036,9 +212848,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210088,9 +212905,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210140,9 +212962,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210192,9 +213019,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210244,9 +213076,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210296,9 +213133,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210348,9 +213190,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210400,9 +213247,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210452,9 +213304,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210504,9 +213361,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210556,9 +213418,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210608,9 +213475,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210660,9 +213532,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210712,9 +213589,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210764,9 +213646,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210816,9 +213703,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210868,9 +213760,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210920,9 +213817,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -210972,9 +213874,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211024,9 +213931,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211076,9 +213988,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211128,9 +214045,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211180,9 +214102,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211232,9 +214159,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211284,9 +214216,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211336,9 +214273,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211388,9 +214330,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211440,9 +214387,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211492,9 +214444,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211544,9 +214501,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211596,9 +214558,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211648,9 +214615,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211700,9 +214672,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211752,9 +214729,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211804,9 +214786,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211856,9 +214843,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211908,9 +214900,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -211960,9 +214957,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212012,9 +215014,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212064,9 +215071,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212116,9 +215128,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212168,9 +215185,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212220,9 +215242,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212272,9 +215299,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212324,9 +215356,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212376,9 +215413,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212428,9 +215470,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212480,9 +215527,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212532,9 +215584,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212584,9 +215641,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212636,9 +215698,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212688,9 +215755,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212740,9 +215812,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212792,9 +215869,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212844,9 +215926,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212896,9 +215983,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -212948,9 +216040,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213000,9 +216097,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213052,9 +216154,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213104,9 +216211,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213156,9 +216268,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213208,9 +216325,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213260,9 +216382,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213312,9 +216439,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213364,9 +216496,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213416,9 +216553,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213468,9 +216610,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213520,9 +216667,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213572,9 +216724,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213624,9 +216781,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213676,9 +216838,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213728,9 +216895,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213780,9 +216952,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213832,9 +217009,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213884,9 +217066,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213936,9 +217123,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -213988,9 +217180,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214040,9 +217237,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214092,9 +217294,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214144,9 +217351,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214196,9 +217408,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214248,9 +217465,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214300,9 +217522,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214352,9 +217579,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214404,9 +217636,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214456,9 +217693,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214508,9 +217750,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214560,9 +217807,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214612,9 +217864,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214664,9 +217921,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214716,9 +217978,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214768,9 +218035,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214820,9 +218092,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214872,9 +218149,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214924,9 +218206,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -214976,9 +218263,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215028,9 +218320,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215080,9 +218377,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215132,9 +218434,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215184,9 +218491,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215236,9 +218548,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215288,9 +218605,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215340,9 +218662,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215392,9 +218719,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215444,9 +218776,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215496,9 +218833,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215548,9 +218890,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215600,9 +218947,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215652,9 +219004,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215704,9 +219061,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215756,9 +219118,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215808,9 +219175,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215860,9 +219232,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215912,9 +219289,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -215964,9 +219346,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216016,9 +219403,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216068,9 +219460,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216120,9 +219517,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216172,9 +219574,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216224,9 +219631,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216276,9 +219688,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216328,9 +219745,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216380,9 +219802,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216432,9 +219859,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216484,9 +219916,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216536,9 +219973,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216588,9 +220030,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216640,9 +220087,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216692,9 +220144,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216744,9 +220201,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216796,9 +220258,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216848,9 +220315,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216900,9 +220372,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -216952,9 +220429,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217004,9 +220486,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217056,9 +220543,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217108,9 +220600,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217160,9 +220657,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217212,9 +220714,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217264,9 +220771,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217316,9 +220828,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217368,9 +220885,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217420,9 +220942,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217472,9 +220999,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217524,9 +221056,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217576,9 +221113,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217628,9 +221170,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217680,9 +221227,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217732,9 +221284,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217784,9 +221341,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217836,9 +221398,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217888,9 +221455,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217940,9 +221512,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -217992,9 +221569,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218044,9 +221626,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218096,9 +221683,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218148,9 +221740,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218200,9 +221797,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218252,9 +221854,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218304,9 +221911,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218356,9 +221968,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218408,9 +222025,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218460,9 +222082,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218512,9 +222139,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218564,9 +222196,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218616,9 +222253,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218668,9 +222310,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218720,9 +222367,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218772,9 +222424,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218824,9 +222481,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218876,9 +222538,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218928,9 +222595,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -218980,9 +222652,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219032,9 +222709,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219084,9 +222766,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219136,9 +222823,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219188,9 +222880,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219240,9 +222937,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219292,9 +222994,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219344,9 +223051,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219396,9 +223108,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219448,9 +223165,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219500,9 +223222,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219552,9 +223279,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219604,9 +223336,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219656,9 +223393,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219708,9 +223450,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219760,9 +223507,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219812,9 +223564,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219864,9 +223621,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219916,9 +223678,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -219968,9 +223735,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220020,9 +223792,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220072,9 +223849,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220124,9 +223906,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220176,9 +223963,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220228,9 +224020,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220280,9 +224077,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220332,9 +224134,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220384,9 +224191,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220436,9 +224248,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220488,9 +224305,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220540,9 +224362,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220592,9 +224419,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220644,9 +224476,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220696,9 +224533,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220748,9 +224590,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220800,9 +224647,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220852,9 +224704,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220904,9 +224761,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -220956,9 +224818,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221008,9 +224875,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221060,9 +224932,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221112,9 +224989,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221164,9 +225046,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221216,9 +225103,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221268,9 +225160,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221320,9 +225217,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221372,9 +225274,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221424,9 +225331,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221476,9 +225388,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221528,9 +225445,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221580,9 +225502,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221632,9 +225559,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221684,9 +225616,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221736,9 +225673,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221788,9 +225730,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221840,9 +225787,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221892,9 +225844,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221944,9 +225901,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -221996,9 +225958,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222048,9 +226015,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222100,9 +226072,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222152,9 +226129,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222204,9 +226186,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222256,9 +226243,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222308,9 +226300,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222360,9 +226357,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222412,9 +226414,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222464,9 +226471,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222516,9 +226528,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222568,9 +226585,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222620,9 +226642,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222672,9 +226699,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
@@ -222724,9 +226756,14 @@ T1568.002,No,-,2
 T1594,No,-,2
 T1565.001,No,-,2
 T1606.002,No,-,2
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-1
-T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-1
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml,-6
+T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml,-6
 T1484.002,No,-,2
 T1568.001,No,-,2
 T1218.004,No,-,2
diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json
index ed8836188f..25f402e7ab 100644
--- a/docs/mitre-map/detections.json
+++ b/docs/mitre-map/detections.json
@@ -24983,9 +24983,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25010,9 +25010,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25037,9 +25037,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25064,9 +25064,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25091,9 +25091,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25118,9 +25118,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25145,9 +25145,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25172,9 +25172,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25199,9 +25199,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25226,9 +25226,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25253,9 +25253,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25280,9 +25280,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25307,9 +25307,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25334,9 +25334,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25361,9 +25361,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25388,9 +25388,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25415,9 +25415,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25442,9 +25442,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25469,9 +25469,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25496,9 +25496,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25523,9 +25523,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25550,9 +25550,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25577,9 +25577,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25604,9 +25604,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25631,9 +25631,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25658,9 +25658,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25685,9 +25685,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25712,9 +25712,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25739,9 +25739,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25766,9 +25766,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25793,9 +25793,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25820,9 +25820,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25847,9 +25847,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25874,9 +25874,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25901,9 +25901,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25928,9 +25928,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25955,9 +25955,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -25982,9 +25982,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26009,9 +26009,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26036,9 +26036,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26063,9 +26063,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26090,9 +26090,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26117,9 +26117,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26144,9 +26144,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26171,9 +26171,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26198,9 +26198,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26225,9 +26225,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26252,9 +26252,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26279,9 +26279,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26306,9 +26306,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26333,9 +26333,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26360,9 +26360,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26387,9 +26387,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26414,9 +26414,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26441,9 +26441,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26468,9 +26468,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26495,9 +26495,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26522,9 +26522,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26549,9 +26549,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26576,9 +26576,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26603,9 +26603,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26630,9 +26630,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26657,9 +26657,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26684,9 +26684,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26711,9 +26711,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26738,9 +26738,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26765,9 +26765,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26792,9 +26792,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26819,9 +26819,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26846,9 +26846,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26873,9 +26873,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26900,9 +26900,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26927,9 +26927,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26954,9 +26954,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -26981,9 +26981,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27008,9 +27008,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27035,9 +27035,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27062,9 +27062,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27089,9 +27089,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27116,9 +27116,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27143,9 +27143,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27170,9 +27170,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27197,9 +27197,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27224,9 +27224,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27251,9 +27251,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27278,9 +27278,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27305,9 +27305,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27332,9 +27332,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27359,9 +27359,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27386,9 +27386,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27413,9 +27413,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27440,9 +27440,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27467,9 +27467,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27494,9 +27494,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27521,9 +27521,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27548,9 +27548,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27575,9 +27575,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27602,9 +27602,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27629,9 +27629,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27656,9 +27656,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27683,9 +27683,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27710,9 +27710,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27737,9 +27737,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27764,9 +27764,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27791,9 +27791,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27818,9 +27818,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27845,9 +27845,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27872,9 +27872,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27899,9 +27899,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27926,9 +27926,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27953,9 +27953,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -27980,9 +27980,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28007,9 +28007,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28034,9 +28034,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28061,9 +28061,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28088,9 +28088,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28115,9 +28115,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28142,9 +28142,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28169,9 +28169,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28196,9 +28196,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28223,9 +28223,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28250,9 +28250,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28277,9 +28277,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28304,9 +28304,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28331,9 +28331,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28358,9 +28358,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28385,9 +28385,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28412,9 +28412,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28439,9 +28439,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28466,9 +28466,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28493,9 +28493,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28520,9 +28520,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28547,9 +28547,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28574,9 +28574,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28601,9 +28601,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28628,9 +28628,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28655,9 +28655,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28682,9 +28682,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28709,9 +28709,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28736,9 +28736,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28763,9 +28763,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28790,9 +28790,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28817,9 +28817,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28844,9 +28844,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28871,9 +28871,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28898,9 +28898,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28925,9 +28925,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28952,9 +28952,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -28979,9 +28979,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29006,9 +29006,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29033,9 +29033,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29060,9 +29060,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29087,9 +29087,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29114,9 +29114,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29141,9 +29141,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29168,9 +29168,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29195,9 +29195,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29222,9 +29222,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29249,9 +29249,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29276,9 +29276,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29303,9 +29303,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29330,9 +29330,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29357,9 +29357,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29384,9 +29384,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29411,9 +29411,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29438,9 +29438,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29465,9 +29465,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29492,9 +29492,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29519,9 +29519,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29546,9 +29546,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29573,9 +29573,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29600,9 +29600,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29627,9 +29627,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29654,9 +29654,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29681,9 +29681,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29708,9 +29708,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29735,9 +29735,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29762,9 +29762,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29789,9 +29789,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29816,9 +29816,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29843,9 +29843,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29870,9 +29870,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29897,9 +29897,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29924,9 +29924,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29951,9 +29951,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -29978,9 +29978,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30005,9 +30005,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30032,9 +30032,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30059,9 +30059,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30086,9 +30086,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30113,9 +30113,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30140,9 +30140,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30167,9 +30167,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30194,9 +30194,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30221,9 +30221,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30248,9 +30248,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30275,9 +30275,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30302,9 +30302,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30329,9 +30329,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30356,9 +30356,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30383,9 +30383,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30410,9 +30410,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30437,9 +30437,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30464,9 +30464,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30491,9 +30491,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30518,9 +30518,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30545,9 +30545,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30572,9 +30572,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30599,9 +30599,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30626,9 +30626,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30653,9 +30653,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30680,9 +30680,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30707,9 +30707,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30734,9 +30734,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30761,9 +30761,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30788,9 +30788,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30815,9 +30815,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30842,9 +30842,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30869,9 +30869,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30896,9 +30896,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30923,9 +30923,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30950,9 +30950,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -30977,9 +30977,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31004,9 +31004,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31031,9 +31031,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31058,9 +31058,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31085,9 +31085,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31112,9 +31112,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31139,9 +31139,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31166,9 +31166,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31193,9 +31193,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31220,9 +31220,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31247,9 +31247,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31274,9 +31274,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31301,9 +31301,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31328,9 +31328,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31355,9 +31355,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31382,9 +31382,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31409,9 +31409,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31436,9 +31436,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31463,9 +31463,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31490,9 +31490,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31517,9 +31517,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31544,9 +31544,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31571,9 +31571,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31598,9 +31598,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31625,9 +31625,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31652,9 +31652,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31679,9 +31679,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31706,9 +31706,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31733,9 +31733,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31760,9 +31760,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31787,9 +31787,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31814,9 +31814,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31841,9 +31841,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31868,9 +31868,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31895,9 +31895,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31922,9 +31922,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31949,9 +31949,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -31976,9 +31976,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32003,9 +32003,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32030,9 +32030,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32057,9 +32057,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32084,9 +32084,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32111,9 +32111,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32138,9 +32138,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32165,9 +32165,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32192,9 +32192,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32219,9 +32219,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32246,9 +32246,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32273,9 +32273,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32300,9 +32300,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32327,9 +32327,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32354,9 +32354,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32381,9 +32381,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32408,9 +32408,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32435,9 +32435,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32462,9 +32462,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32489,9 +32489,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32516,9 +32516,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32543,9 +32543,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32570,9 +32570,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32597,9 +32597,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32624,9 +32624,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32651,9 +32651,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32678,9 +32678,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32705,9 +32705,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32732,9 +32732,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32759,9 +32759,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32786,9 +32786,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32813,9 +32813,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32840,9 +32840,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32867,9 +32867,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32894,9 +32894,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32921,9 +32921,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32948,9 +32948,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -32975,9 +32975,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33002,9 +33002,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33029,9 +33029,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33056,9 +33056,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33083,9 +33083,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33110,9 +33110,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33137,9 +33137,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33164,9 +33164,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33191,9 +33191,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33218,9 +33218,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33245,9 +33245,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33272,9 +33272,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33299,9 +33299,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33326,9 +33326,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33353,9 +33353,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33380,9 +33380,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33407,9 +33407,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33434,9 +33434,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33461,9 +33461,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33488,9 +33488,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33515,9 +33515,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33542,9 +33542,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33569,9 +33569,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33596,9 +33596,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33623,9 +33623,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33650,9 +33650,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33677,9 +33677,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33704,9 +33704,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33731,9 +33731,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33758,9 +33758,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33785,9 +33785,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33812,9 +33812,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33839,9 +33839,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33866,9 +33866,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33893,9 +33893,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33920,9 +33920,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33947,9 +33947,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -33974,9 +33974,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34001,9 +34001,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34028,9 +34028,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34055,9 +34055,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34082,9 +34082,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34109,9 +34109,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34136,9 +34136,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34163,9 +34163,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34190,9 +34190,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34217,9 +34217,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34244,9 +34244,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34271,9 +34271,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34298,9 +34298,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34325,9 +34325,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34352,9 +34352,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34379,9 +34379,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34406,9 +34406,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34433,9 +34433,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34460,9 +34460,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34487,9 +34487,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34514,9 +34514,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34541,9 +34541,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34568,9 +34568,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34595,9 +34595,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34622,9 +34622,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34649,9 +34649,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34676,9 +34676,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34703,9 +34703,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34730,9 +34730,36 @@
         },
         {
             "techniqueID": "T1070.004",
+            "score": 35,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
+        },
+        {
+            "techniqueID": "T1192",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.002",
             "score": 36,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml"
+        },
+        {
+            "techniqueID": "T1598.003",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1107",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.004",
+            "score": 35,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34757,9 +34784,36 @@
         },
         {
             "techniqueID": "T1070.004",
+            "score": 35,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
+        },
+        {
+            "techniqueID": "T1192",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.002",
             "score": 36,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml"
+        },
+        {
+            "techniqueID": "T1598.003",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1107",
+            "score": 37,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.004",
+            "score": 35,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34784,63 +34838,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
-        },
-        {
-            "techniqueID": "T1192",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566.002",
-            "score": 36,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml"
-        },
-        {
-            "techniqueID": "T1598.003",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1107",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.004",
-            "score": 36,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
-        },
-        {
-            "techniqueID": "T1192",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566.002",
-            "score": 36,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml"
-        },
-        {
-            "techniqueID": "T1598.003",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1107",
-            "score": 37,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1192",
@@ -34865,9 +34865,9 @@
         },
         {
             "techniqueID": "T1070.004",
-            "score": 36,
+            "score": 35,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml"
         },
         {
             "techniqueID": "T1082",
@@ -37085,8 +37085,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37102,8 +37103,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37119,8 +37121,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37136,8 +37139,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37153,8 +37157,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37170,8 +37175,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37187,8 +37193,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37204,8 +37211,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37221,8 +37229,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37238,8 +37247,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37255,8 +37265,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37272,8 +37283,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37289,8 +37301,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37306,8 +37319,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37323,8 +37337,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37340,8 +37355,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37357,8 +37373,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37374,8 +37391,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37391,8 +37409,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37408,8 +37427,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37425,8 +37445,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37442,8 +37463,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37459,8 +37481,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37476,8 +37499,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37493,8 +37517,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37510,8 +37535,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37527,8 +37553,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37544,8 +37571,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37561,8 +37589,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37578,8 +37607,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37595,8 +37625,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37612,8 +37643,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37629,8 +37661,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37646,8 +37679,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37663,8 +37697,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37680,8 +37715,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37697,8 +37733,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37714,8 +37751,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37731,8 +37769,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37748,8 +37787,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37765,8 +37805,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37782,8 +37823,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37799,8 +37841,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37816,8 +37859,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37833,8 +37877,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37850,8 +37895,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37867,8 +37913,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37884,8 +37931,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37901,8 +37949,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37918,8 +37967,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37935,8 +37985,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37952,8 +38003,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37969,8 +38021,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -37986,8 +38039,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38003,8 +38057,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38020,8 +38075,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38037,8 +38093,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38054,8 +38111,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38071,8 +38129,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38088,8 +38147,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38105,8 +38165,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38122,8 +38183,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38139,8 +38201,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38156,8 +38219,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38173,8 +38237,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38190,8 +38255,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38207,8 +38273,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38224,8 +38291,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38241,8 +38309,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38258,8 +38327,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38275,8 +38345,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38292,8 +38363,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38309,8 +38381,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38326,8 +38399,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38343,8 +38417,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38360,8 +38435,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38377,8 +38453,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38394,8 +38471,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38411,8 +38489,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38428,8 +38507,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38445,8 +38525,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38462,8 +38543,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38479,8 +38561,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38496,8 +38579,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38513,8 +38597,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38530,8 +38615,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38547,8 +38633,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38564,8 +38651,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38581,8 +38669,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38598,8 +38687,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38615,8 +38705,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38632,8 +38723,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38649,8 +38741,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38666,8 +38759,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38683,8 +38777,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38700,8 +38795,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38717,8 +38813,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38734,8 +38831,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38751,8 +38849,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38768,8 +38867,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38785,8 +38885,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38802,8 +38903,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38819,8 +38921,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38836,8 +38939,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38853,8 +38957,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38870,8 +38975,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38887,8 +38993,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38904,8 +39011,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38921,8 +39029,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38938,8 +39047,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38955,8 +39065,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38972,8 +39083,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -38989,8 +39101,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39006,8 +39119,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39023,8 +39137,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39040,8 +39155,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39057,8 +39173,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39074,8 +39191,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39091,8 +39209,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39108,8 +39227,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39125,8 +39245,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39142,8 +39263,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39159,8 +39281,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39176,8 +39299,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39193,8 +39317,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39210,8 +39335,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39227,8 +39353,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39244,8 +39371,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39261,8 +39389,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39278,8 +39407,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39295,8 +39425,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39312,8 +39443,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39329,8 +39461,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39346,8 +39479,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39363,8 +39497,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39380,8 +39515,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39397,8 +39533,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39414,8 +39551,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39431,8 +39569,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39448,8 +39587,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39465,8 +39605,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39482,8 +39623,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39499,8 +39641,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39516,8 +39659,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39533,8 +39677,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39550,8 +39695,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39567,8 +39713,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39584,8 +39731,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39601,8 +39749,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39618,8 +39767,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39635,8 +39785,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39652,8 +39803,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39669,8 +39821,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39686,8 +39839,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39703,8 +39857,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39720,8 +39875,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39737,8 +39893,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39754,8 +39911,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39771,8 +39929,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39788,8 +39947,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39805,8 +39965,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39822,8 +39983,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39839,8 +40001,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39856,8 +40019,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39873,8 +40037,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39890,8 +40055,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39907,8 +40073,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39924,8 +40091,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39941,8 +40109,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39958,8 +40127,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39975,8 +40145,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -39992,8 +40163,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40009,8 +40181,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40026,8 +40199,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40043,8 +40217,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40060,8 +40235,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40077,8 +40253,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40094,8 +40271,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40111,8 +40289,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40128,8 +40307,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40145,8 +40325,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40162,8 +40343,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40179,8 +40361,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40196,8 +40379,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40213,8 +40397,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40230,8 +40415,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40247,8 +40433,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40264,8 +40451,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40281,8 +40469,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40298,8 +40487,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40315,8 +40505,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40332,8 +40523,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40349,8 +40541,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40366,8 +40559,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40383,8 +40577,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40400,8 +40595,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40417,8 +40613,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40434,8 +40631,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40451,8 +40649,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40468,8 +40667,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40485,8 +40685,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40502,8 +40703,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40519,8 +40721,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40536,8 +40739,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40553,8 +40757,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40570,8 +40775,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40587,8 +40793,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40604,8 +40811,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40621,8 +40829,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40638,8 +40847,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40655,8 +40865,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40672,8 +40883,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40689,8 +40901,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40706,8 +40919,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40723,8 +40937,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40740,8 +40955,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40757,8 +40973,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40774,8 +40991,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40791,8 +41009,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40808,8 +41027,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40825,8 +41045,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40842,8 +41063,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40859,8 +41081,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40876,8 +41099,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40893,8 +41117,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40910,8 +41135,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40927,8 +41153,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40944,8 +41171,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40961,8 +41189,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40978,8 +41207,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -40995,8 +41225,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41012,8 +41243,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41029,8 +41261,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41046,8 +41279,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41063,8 +41297,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41080,8 +41315,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41097,8 +41333,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41114,8 +41351,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41131,8 +41369,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41148,8 +41387,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41165,8 +41405,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41182,8 +41423,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41199,8 +41441,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41216,8 +41459,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41233,8 +41477,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41250,8 +41495,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41267,8 +41513,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41284,8 +41531,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41301,8 +41549,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41318,8 +41567,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41335,8 +41585,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41352,8 +41603,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41369,8 +41621,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41386,8 +41639,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41403,8 +41657,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41420,8 +41675,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41437,8 +41693,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41454,8 +41711,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41471,8 +41729,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41488,8 +41747,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41505,8 +41765,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41522,8 +41783,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41539,8 +41801,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41556,8 +41819,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41573,8 +41837,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41590,8 +41855,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41607,8 +41873,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41624,8 +41891,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41641,8 +41909,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41658,8 +41927,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41675,8 +41945,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41692,8 +41963,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41709,8 +41981,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41726,8 +41999,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41743,8 +42017,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41760,8 +42035,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41777,8 +42053,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41794,8 +42071,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41811,8 +42089,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41828,8 +42107,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41845,8 +42125,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41862,8 +42143,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41879,8 +42161,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41896,8 +42179,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41913,8 +42197,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41930,8 +42215,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41947,8 +42233,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41964,8 +42251,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41981,8 +42269,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -41998,8 +42287,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42015,8 +42305,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42032,8 +42323,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42049,8 +42341,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42066,8 +42359,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42083,8 +42377,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42100,8 +42395,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42117,8 +42413,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42134,8 +42431,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42151,8 +42449,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42168,8 +42467,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42185,8 +42485,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42202,8 +42503,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42219,8 +42521,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42236,8 +42539,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42253,8 +42557,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42270,8 +42575,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42287,8 +42593,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42304,8 +42611,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42321,8 +42629,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42338,8 +42647,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42355,8 +42665,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42372,8 +42683,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42389,8 +42701,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42406,8 +42719,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42423,8 +42737,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42440,8 +42755,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42457,8 +42773,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42474,8 +42791,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42491,8 +42809,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42508,8 +42827,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42525,8 +42845,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42542,8 +42863,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42559,8 +42881,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42576,8 +42899,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42593,8 +42917,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42610,8 +42935,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42627,8 +42953,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42644,8 +42971,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42661,8 +42989,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42678,8 +43007,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42695,8 +43025,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42712,8 +43043,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42729,8 +43061,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42746,8 +43079,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42763,8 +43097,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42780,8 +43115,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42797,8 +43133,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42814,8 +43151,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42831,8 +43169,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42848,8 +43187,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42865,8 +43205,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42882,8 +43223,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42899,8 +43241,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42916,8 +43259,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42933,8 +43277,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42950,8 +43295,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42967,8 +43313,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -42984,8 +43331,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43001,8 +43349,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43018,8 +43367,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43035,8 +43385,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43052,8 +43403,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43069,8 +43421,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43086,8 +43439,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43103,8 +43457,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43120,8 +43475,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43137,8 +43493,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43154,8 +43511,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43171,8 +43529,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43188,8 +43547,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43205,8 +43565,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43222,8 +43583,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43239,8 +43601,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43256,8 +43619,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43273,8 +43637,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43290,8 +43655,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1053.005",
@@ -43307,8 +43673,9 @@
         },
         {
             "techniqueID": "T1059.005",
-            "score": 35,
-            "showSubtechniques": false
+            "score": 34,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml"
         },
         {
             "techniqueID": "T1078",
@@ -94068,261 +94435,486 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1133",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.001",
+            "score": 18,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1112",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+        },
+        {
+            "techniqueID": "T1003",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1136.001",
+            "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
-        {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1003",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1136.001",
+            "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
-        {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1003",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1136.001",
+            "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
-        {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1003",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1136.001",
+            "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
-        {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1003",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
-            "showSubtechniques": false
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1133",
-            "score": 18,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1112",
-            "score": 15,
+            "techniqueID": "T1136.001",
+            "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
-        {
-            "techniqueID": "T1133",
-            "score": 18,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1074.001",
-            "score": 18,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
-        {
-            "techniqueID": "T1112",
-            "score": 15,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
-        },
         {
             "techniqueID": "T1003",
             "score": 5,
@@ -110614,229 +111206,116 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 12,
+            "techniqueID": "T1218.011",
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
         },
         {
-            "techniqueID": "T1543.003",
-            "score": 13,
+            "techniqueID": "T1087.002",
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1036",
-            "score": 13,
+            "techniqueID": "T1021.002",
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
         },
         {
-            "techniqueID": "T1136.001",
+            "techniqueID": "T1505.003",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 12,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
         },
         {
-            "techniqueID": "T1555.003",
-            "score": 17,
+            "techniqueID": "T1085",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
+            "techniqueID": "T1136.002",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 12,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
+            "techniqueID": "T1073",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.003",
-            "score": 17,
+            "techniqueID": "T1100",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.001",
+            "techniqueID": "T1046",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1003",
-            "score": 5,
+            "techniqueID": "T1574.002",
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
-            "techniqueID": "T1087.001",
-            "score": 12,
+            "techniqueID": "T1218.011",
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
         },
         {
-            "techniqueID": "T1543.003",
-            "score": 13,
+            "techniqueID": "T1087.002",
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1036",
-            "score": 13,
+            "techniqueID": "T1021.002",
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
         },
         {
-            "techniqueID": "T1136.001",
+            "techniqueID": "T1505.003",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
         },
         {
-            "techniqueID": "T1041",
-            "score": 17,
+            "techniqueID": "T1085",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 12,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+            "techniqueID": "T1136.002",
+            "score": 16,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1503",
-            "score": 17,
+            "techniqueID": "T1073",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.003",
-            "score": 17,
+            "techniqueID": "T1100",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.001",
+            "techniqueID": "T1046",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
+            "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -110890,8 +111369,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -110945,8 +111425,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111000,8 +111481,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111055,8 +111537,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111110,8 +111593,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111165,8 +111649,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111220,8 +111705,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111275,8 +111761,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111330,8 +111817,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111385,8 +111873,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111440,8 +111929,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111495,8 +111985,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111550,8 +112041,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111605,8 +112097,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111660,8 +112153,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111715,8 +112209,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111770,8 +112265,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111825,8 +112321,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111880,8 +112377,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111935,8 +112433,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -111990,8 +112489,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112045,8 +112545,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112100,8 +112601,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112155,8 +112657,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112210,8 +112713,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112265,8 +112769,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112320,8 +112825,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112375,8 +112881,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112430,8 +112937,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112485,8 +112993,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112540,8 +113049,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112595,8 +113105,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112650,8 +113161,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112705,8 +113217,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112760,8 +113273,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -112815,9 +113329,66 @@
         },
         {
             "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+        },
+        {
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
             "score": 16,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1136.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1073",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1100",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1046",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1218.011",
             "score": 7,
@@ -112870,9 +113441,66 @@
         },
         {
             "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+        },
+        {
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1073",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1100",
             "score": 16,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1046",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1218.011",
             "score": 7,
@@ -112925,9 +113553,66 @@
         },
         {
             "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+        },
+        {
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1073",
             "score": 16,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1100",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1046",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1218.011",
             "score": 7,
@@ -112980,63 +113665,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113090,8 +113721,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113145,8 +113777,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113200,8 +113833,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113255,8 +113889,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113310,8 +113945,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113365,8 +114001,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113420,8 +114057,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113475,8 +114113,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113530,8 +114169,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113585,8 +114225,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113640,8 +114281,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113695,8 +114337,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113750,8 +114393,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113805,8 +114449,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113860,8 +114505,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113915,8 +114561,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -113970,8 +114617,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114025,8 +114673,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114080,8 +114729,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114135,8 +114785,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114190,8 +114841,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114245,8 +114897,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114300,8 +114953,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114355,8 +115009,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114410,8 +115065,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114465,8 +115121,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114520,8 +115177,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114575,8 +115233,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114630,8 +115289,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114685,8 +115345,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114740,8 +115401,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114795,8 +115457,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114850,8 +115513,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114905,8 +115569,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -114960,8 +115625,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115015,8 +115681,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115070,8 +115737,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115125,8 +115793,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115180,8 +115849,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115235,8 +115905,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115290,8 +115961,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115345,8 +116017,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115400,8 +116073,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115455,8 +116129,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115510,8 +116185,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115565,8 +116241,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115620,8 +116297,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115675,8 +116353,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115730,8 +116409,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115785,8 +116465,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115840,63 +116521,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -115950,8 +116577,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116005,8 +116633,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116060,8 +116689,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116115,8 +116745,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116170,8 +116801,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116225,8 +116857,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116280,8 +116913,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116335,8 +116969,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116390,8 +117025,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116445,8 +117081,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116500,8 +117137,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116555,8 +117193,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116610,8 +117249,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116665,8 +117305,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116720,8 +117361,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116775,8 +117417,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116830,8 +117473,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116885,8 +117529,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116940,8 +117585,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -116995,8 +117641,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117050,8 +117697,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117105,8 +117753,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117160,8 +117809,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117215,8 +117865,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117270,8 +117921,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117325,8 +117977,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117380,8 +118033,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117435,8 +118089,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117490,8 +118145,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117545,8 +118201,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117600,8 +118257,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117655,8 +118313,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117710,8 +118369,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117765,8 +118425,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117820,8 +118481,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117875,8 +118537,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117930,8 +118593,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -117985,8 +118649,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118040,8 +118705,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118095,8 +118761,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118150,8 +118817,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118205,8 +118873,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118260,8 +118929,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118315,8 +118985,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118370,8 +119041,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118425,8 +119097,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118480,8 +119153,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118535,8 +119209,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118590,8 +119265,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118645,8 +119321,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118700,63 +119377,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118810,8 +119433,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118865,8 +119489,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118920,8 +119545,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -118975,8 +119601,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119030,8 +119657,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119085,8 +119713,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119140,8 +119769,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119195,8 +119825,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119250,8 +119881,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119305,8 +119937,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119360,8 +119993,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119415,8 +120049,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119470,8 +120105,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119525,8 +120161,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119580,8 +120217,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119635,8 +120273,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119690,8 +120329,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119745,8 +120385,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119800,8 +120441,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119855,8 +120497,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119910,8 +120553,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -119965,8 +120609,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120020,8 +120665,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120075,8 +120721,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120130,8 +120777,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120185,8 +120833,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120240,8 +120889,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120295,8 +120945,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120350,8 +121001,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120405,8 +121057,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120460,8 +121113,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120515,8 +121169,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120570,8 +121225,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120625,8 +121281,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120680,8 +121337,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120735,8 +121393,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120790,8 +121449,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120845,8 +121505,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120900,8 +121561,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -120955,8 +121617,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121010,8 +121673,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121065,8 +121729,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121120,8 +121785,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121175,8 +121841,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121230,8 +121897,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121285,8 +121953,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121340,8 +122009,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121395,8 +122065,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121450,8 +122121,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121505,8 +122177,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121560,63 +122233,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121670,8 +122289,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121725,8 +122345,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121780,8 +122401,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121835,8 +122457,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121890,8 +122513,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -121945,8 +122569,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122000,8 +122625,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122055,8 +122681,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122110,8 +122737,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122165,8 +122793,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122220,8 +122849,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122275,8 +122905,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122330,8 +122961,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122385,8 +123017,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122440,8 +123073,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122495,8 +123129,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122550,8 +123185,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122605,8 +123241,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122660,8 +123297,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122715,8 +123353,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122770,8 +123409,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122825,8 +123465,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122880,8 +123521,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122935,8 +123577,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -122990,8 +123633,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123045,8 +123689,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123100,8 +123745,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123155,8 +123801,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123210,8 +123857,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123265,8 +123913,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123320,8 +123969,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123375,8 +124025,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123430,8 +124081,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123485,8 +124137,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123540,8 +124193,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123595,8 +124249,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123650,8 +124305,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123705,8 +124361,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123760,8 +124417,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123815,8 +124473,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123870,8 +124529,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123925,8 +124585,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -123980,8 +124641,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124035,8 +124697,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124090,8 +124753,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124145,8 +124809,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124200,8 +124865,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124255,8 +124921,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124310,8 +124977,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124365,8 +125033,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124420,63 +125089,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124530,8 +125145,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124585,8 +125201,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124640,8 +125257,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124695,8 +125313,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124750,8 +125369,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124805,8 +125425,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124860,8 +125481,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124915,8 +125537,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -124970,8 +125593,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125025,8 +125649,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125080,8 +125705,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125135,8 +125761,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125190,8 +125817,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125245,8 +125873,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125300,8 +125929,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125355,8 +125985,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125410,8 +126041,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125465,8 +126097,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125520,8 +126153,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125575,8 +126209,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125630,8 +126265,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125685,8 +126321,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125740,8 +126377,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125795,8 +126433,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125850,8 +126489,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125905,8 +126545,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -125960,8 +126601,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126015,8 +126657,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126070,8 +126713,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126125,8 +126769,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126180,8 +126825,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126235,8 +126881,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126290,8 +126937,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126345,8 +126993,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126400,8 +127049,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126455,8 +127105,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126510,8 +127161,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126565,8 +127217,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126620,8 +127273,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126675,8 +127329,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126730,8 +127385,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126785,8 +127441,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126840,8 +127497,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126895,8 +127553,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -126950,8 +127609,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127005,8 +127665,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127060,8 +127721,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127115,8 +127777,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127170,8 +127833,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127225,8 +127889,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127280,63 +127945,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.011",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1087.002",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
-        },
-        {
-            "techniqueID": "T1021.002",
-            "score": 11,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
-        },
-        {
-            "techniqueID": "T1505.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
-        },
-        {
-            "techniqueID": "T1085",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.002",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1073",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1100",
-            "score": 16,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1046",
-            "score": 14,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127390,8 +128001,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127445,8 +128057,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127500,8 +128113,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127555,8 +128169,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127610,8 +128225,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127665,8 +128281,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127720,8 +128337,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127775,8 +128393,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127830,8 +128449,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127885,8 +128505,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127940,8 +128561,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -127995,8 +128617,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128050,8 +128673,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128105,8 +128729,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128160,8 +128785,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128215,8 +128841,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128270,8 +128897,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128325,8 +128953,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128380,8 +129009,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128435,8 +129065,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128490,8 +129121,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128545,8 +129177,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128600,8 +129233,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128655,8 +129289,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128710,8 +129345,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128765,8 +129401,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128820,8 +129457,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128875,8 +129513,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128930,8 +129569,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -128985,8 +129625,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129040,8 +129681,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129095,8 +129737,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129150,8 +129793,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129205,8 +129849,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129260,8 +129905,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129315,8 +129961,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129370,8 +130017,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129425,8 +130073,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129480,8 +130129,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129535,8 +130185,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129590,8 +130241,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129645,8 +130297,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129700,8 +130353,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129755,8 +130409,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129810,8 +130465,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129865,8 +130521,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129920,8 +130577,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -129975,8 +130633,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130030,8 +130689,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130085,8 +130745,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130140,8 +130801,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130195,8 +130857,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130250,8 +130913,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130305,8 +130969,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130360,8 +131025,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130415,8 +131081,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130470,8 +131137,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130525,8 +131193,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130580,8 +131249,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130635,8 +131305,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130690,8 +131361,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130745,8 +131417,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130800,8 +131473,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130855,8 +131529,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130910,8 +131585,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -130965,8 +131641,9 @@
         },
         {
             "techniqueID": "T1574.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
         },
         {
             "techniqueID": "T1218.011",
@@ -131020,9 +131697,66 @@
         },
         {
             "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+        },
+        {
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1073",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1100",
             "score": 16,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1046",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1574.002",
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml"
+        },
         {
             "techniqueID": "T1063",
             "score": 15,
@@ -146454,9 +147188,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146480,9 +147214,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146506,9 +147240,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146532,9 +147266,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146558,9 +147292,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146584,9 +147318,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146610,9 +147344,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146636,9 +147370,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146662,9 +147396,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146688,9 +147422,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146714,9 +147448,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146740,9 +147474,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146766,9 +147500,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146792,9 +147526,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146818,9 +147552,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146844,9 +147578,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146870,9 +147604,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146896,9 +147630,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146922,9 +147656,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146948,9 +147682,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146974,9 +147708,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147000,9 +147734,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147026,9 +147760,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147052,9 +147786,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147078,9 +147812,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147104,9 +147838,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147130,9 +147864,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147156,9 +147890,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147182,9 +147916,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147208,9 +147942,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147234,9 +147968,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147260,9 +147994,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147286,9 +148020,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147312,9 +148046,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147338,9 +148072,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147364,9 +148098,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147390,9 +148124,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147416,9 +148150,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147442,9 +148176,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147468,9 +148202,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147494,9 +148228,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147520,9 +148254,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147546,9 +148280,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147572,9 +148306,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147598,9 +148332,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147624,9 +148358,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147650,9 +148384,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147676,9 +148410,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147702,9 +148436,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147728,9 +148462,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147754,9 +148488,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147780,9 +148514,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147806,9 +148540,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147832,9 +148566,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147858,9 +148592,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147884,9 +148618,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147910,9 +148644,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147936,9 +148670,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147962,9 +148696,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147988,9 +148722,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148014,9 +148748,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148040,9 +148774,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148066,9 +148800,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148092,9 +148826,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148118,9 +148852,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148144,9 +148878,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148170,9 +148904,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148196,9 +148930,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148222,9 +148956,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148248,9 +148982,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148274,9 +149008,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148300,9 +149034,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148326,9 +149060,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148352,9 +149086,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148378,9 +149112,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148404,9 +149138,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148430,9 +149164,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148456,9 +149190,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148482,9 +149216,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148508,9 +149242,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148534,9 +149268,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148560,9 +149294,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148586,9 +149320,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148612,9 +149346,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148638,9 +149372,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148664,9 +149398,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148690,9 +149424,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148716,9 +149450,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148742,9 +149476,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148768,9 +149502,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148794,9 +149528,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148820,9 +149554,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148846,9 +149580,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148872,9 +149606,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148898,9 +149632,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148924,9 +149658,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148950,9 +149684,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148976,9 +149710,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149002,9 +149736,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149028,9 +149762,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149054,9 +149788,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149080,9 +149814,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149106,9 +149840,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149132,9 +149866,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149158,9 +149892,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149184,9 +149918,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149210,9 +149944,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149236,9 +149970,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149262,9 +149996,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149288,9 +150022,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149314,9 +150048,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149340,9 +150074,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149366,9 +150100,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149392,9 +150126,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149418,9 +150152,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149444,9 +150178,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149470,9 +150204,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149496,9 +150230,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149522,9 +150256,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149548,9 +150282,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149574,9 +150308,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149600,9 +150334,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149626,9 +150360,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149652,9 +150386,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149678,9 +150412,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149704,9 +150438,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149730,9 +150464,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149756,9 +150490,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149782,9 +150516,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149808,9 +150542,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149834,9 +150568,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149860,9 +150594,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149886,9 +150620,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149912,9 +150646,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149938,9 +150672,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149964,9 +150698,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149990,9 +150724,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150016,9 +150750,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150042,9 +150776,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150068,9 +150802,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150094,9 +150828,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150120,9 +150854,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150146,9 +150880,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150172,9 +150906,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150198,9 +150932,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150224,9 +150958,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150250,9 +150984,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150276,9 +151010,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150302,9 +151036,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150328,9 +151062,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150354,9 +151088,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150380,9 +151114,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150406,9 +151140,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150432,9 +151166,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150458,9 +151192,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150484,9 +151218,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150510,9 +151244,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150536,9 +151270,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150562,9 +151296,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150588,9 +151322,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150614,9 +151348,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150640,9 +151374,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150666,9 +151400,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150692,9 +151426,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150718,9 +151452,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150744,9 +151478,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150770,9 +151504,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150796,9 +151530,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150822,9 +151556,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150848,9 +151582,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150874,9 +151608,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150900,9 +151634,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150926,9 +151660,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150952,9 +151686,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150978,9 +151712,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151004,9 +151738,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151030,9 +151764,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151056,9 +151790,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151082,9 +151816,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151108,9 +151842,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151134,9 +151868,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151160,9 +151894,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151186,9 +151920,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151212,9 +151946,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151238,9 +151972,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151264,9 +151998,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151290,9 +152024,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151316,9 +152050,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151342,9 +152076,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151368,9 +152102,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151394,9 +152128,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151420,9 +152154,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151446,9 +152180,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151472,9 +152206,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151498,9 +152232,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151524,9 +152258,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151550,9 +152284,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151576,9 +152310,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151602,9 +152336,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151628,9 +152362,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151654,9 +152388,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151680,9 +152414,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151706,9 +152440,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151732,9 +152466,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151758,9 +152492,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151784,9 +152518,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151810,9 +152544,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151836,9 +152570,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151862,9 +152596,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151888,9 +152622,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151914,9 +152648,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151940,9 +152674,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151966,9 +152700,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151992,9 +152726,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152018,9 +152752,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152044,9 +152778,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152070,9 +152804,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152096,9 +152830,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152122,9 +152856,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152148,9 +152882,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152174,9 +152908,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152200,9 +152934,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152226,9 +152960,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152252,9 +152986,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152278,9 +153012,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152304,9 +153038,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152330,9 +153064,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152356,9 +153090,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152382,9 +153116,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152408,9 +153142,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152434,9 +153168,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152460,9 +153194,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152486,9 +153220,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152512,9 +153246,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152538,9 +153272,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152564,9 +153298,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152590,9 +153324,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152616,9 +153350,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152642,9 +153376,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152668,9 +153402,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152694,9 +153428,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152720,9 +153454,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152746,9 +153480,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152772,9 +153506,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152798,9 +153532,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152824,9 +153558,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152850,9 +153584,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152876,9 +153610,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152902,9 +153636,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152928,9 +153662,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152954,9 +153688,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152980,9 +153714,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153006,9 +153740,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153032,9 +153766,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153058,9 +153792,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153084,9 +153818,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153110,9 +153844,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153136,9 +153870,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153162,9 +153896,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153188,9 +153922,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153214,9 +153948,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153240,9 +153974,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153266,9 +154000,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153292,9 +154026,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153318,9 +154052,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153344,9 +154078,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153370,9 +154104,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153396,9 +154130,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153422,9 +154156,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153448,9 +154182,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153474,9 +154208,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153500,9 +154234,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153526,9 +154260,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153552,9 +154286,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153578,9 +154312,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153604,9 +154338,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153630,9 +154364,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153656,9 +154390,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153682,9 +154416,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153708,9 +154442,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153734,9 +154468,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153760,9 +154494,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153786,9 +154520,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153812,9 +154546,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153838,9 +154572,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153864,9 +154598,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153890,9 +154624,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153916,9 +154650,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153942,9 +154676,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153968,9 +154702,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153994,9 +154728,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154020,9 +154754,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154046,9 +154780,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154072,9 +154806,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154098,9 +154832,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154124,9 +154858,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154150,9 +154884,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154176,9 +154910,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154202,9 +154936,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154228,9 +154962,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154254,9 +154988,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154280,9 +155014,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154306,9 +155040,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154332,9 +155066,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154358,9 +155092,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154384,9 +155118,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154410,9 +155144,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154436,9 +155170,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154462,9 +155196,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154488,9 +155222,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154514,9 +155248,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154540,9 +155274,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154566,9 +155300,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154592,9 +155326,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154618,9 +155352,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154644,9 +155378,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154670,9 +155404,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154696,9 +155430,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154722,9 +155456,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154748,9 +155482,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154774,9 +155508,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154800,9 +155534,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154826,9 +155560,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154852,9 +155586,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154878,9 +155612,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154904,9 +155638,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154930,9 +155664,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154956,9 +155690,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154982,9 +155716,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155008,9 +155742,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155034,9 +155768,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155060,9 +155794,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155086,9 +155820,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155112,9 +155846,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155138,9 +155872,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155164,9 +155898,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155190,9 +155924,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155216,9 +155950,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155242,9 +155976,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155268,9 +156002,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155294,9 +156028,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155320,9 +156054,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155346,9 +156080,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155372,9 +156106,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155398,9 +156132,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155424,9 +156158,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155450,9 +156184,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155476,9 +156210,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155502,9 +156236,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155528,9 +156262,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155554,9 +156288,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155580,9 +156314,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155606,9 +156340,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155632,9 +156366,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155658,9 +156392,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155684,9 +156418,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155710,9 +156444,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155736,9 +156470,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155762,9 +156496,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155788,9 +156522,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155814,9 +156548,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155840,9 +156574,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155866,9 +156600,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155892,9 +156626,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155918,9 +156652,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155944,9 +156678,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155970,9 +156704,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -5,
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -165934,9 +166668,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165989,9 +166723,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166044,9 +166778,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166099,9 +166833,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166154,9 +166888,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166209,9 +166943,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166264,9 +166998,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166319,9 +167053,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166374,9 +167108,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166429,9 +167163,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166484,9 +167218,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166539,9 +167273,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166594,9 +167328,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166649,9 +167383,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166704,9 +167438,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166759,9 +167493,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166814,9 +167548,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166869,9 +167603,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166924,9 +167658,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166979,9 +167713,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167034,9 +167768,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167089,9 +167823,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167144,9 +167878,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167199,9 +167933,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167254,9 +167988,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167309,9 +168043,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167364,9 +168098,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167419,9 +168153,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167474,9 +168208,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167529,9 +168263,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167584,9 +168318,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167639,9 +168373,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167694,9 +168428,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167749,9 +168483,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167804,9 +168538,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167859,9 +168593,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167914,9 +168648,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167969,9 +168703,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168024,9 +168758,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168079,9 +168813,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168134,9 +168868,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168189,9 +168923,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168244,9 +168978,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168299,9 +169033,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168354,9 +169088,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168409,9 +169143,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168464,9 +169198,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168519,9 +169253,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168574,9 +169308,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168629,9 +169363,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168684,9 +169418,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168739,9 +169473,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168794,9 +169528,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168849,9 +169583,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168904,9 +169638,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168959,9 +169693,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169014,9 +169748,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169069,9 +169803,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169124,9 +169858,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169179,9 +169913,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169234,9 +169968,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169289,9 +170023,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169344,9 +170078,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169399,9 +170133,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169454,9 +170188,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169509,9 +170243,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169564,9 +170298,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169619,9 +170353,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169674,9 +170408,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169729,9 +170463,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169784,9 +170518,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169839,9 +170573,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169894,9 +170628,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169949,9 +170683,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170004,9 +170738,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170059,9 +170793,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170114,9 +170848,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170169,9 +170903,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170224,9 +170958,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170279,9 +171013,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170334,9 +171068,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170389,9 +171123,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170444,9 +171178,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170499,9 +171233,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170554,9 +171288,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170609,9 +171343,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170664,9 +171398,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170719,9 +171453,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170774,9 +171508,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170829,9 +171563,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170884,9 +171618,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170939,9 +171673,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170994,9 +171728,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171049,9 +171783,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171104,9 +171838,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171159,9 +171893,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171214,9 +171948,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171269,9 +172003,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171324,9 +172058,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171379,9 +172113,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171434,9 +172168,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171489,9 +172223,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171544,9 +172278,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171599,9 +172333,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171654,9 +172388,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171709,9 +172443,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171764,9 +172498,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171819,9 +172553,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171874,9 +172608,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171929,9 +172663,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171984,9 +172718,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172039,9 +172773,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172094,9 +172828,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172149,9 +172883,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172204,9 +172938,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172259,9 +172993,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172314,9 +173048,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172369,9 +173103,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172424,9 +173158,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172479,9 +173213,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172534,9 +173268,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172589,9 +173323,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172644,9 +173378,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172699,9 +173433,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172754,9 +173488,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172809,9 +173543,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172864,9 +173598,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172919,9 +173653,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172974,9 +173708,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173029,9 +173763,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173084,9 +173818,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173139,9 +173873,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173194,9 +173928,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173249,9 +173983,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173304,9 +174038,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173359,9 +174093,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173414,9 +174148,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173469,9 +174203,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173524,9 +174258,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173579,9 +174313,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173634,9 +174368,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173689,9 +174423,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173744,9 +174478,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173799,9 +174533,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173854,9 +174588,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173909,9 +174643,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173964,9 +174698,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174019,9 +174753,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174074,9 +174808,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174129,9 +174863,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174184,9 +174918,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174239,9 +174973,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174294,9 +175028,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174349,9 +175083,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174404,9 +175138,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174459,9 +175193,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174514,9 +175248,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174569,9 +175303,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174624,9 +175358,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174679,9 +175413,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174734,9 +175468,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174789,9 +175523,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174844,9 +175578,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174899,9 +175633,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174954,9 +175688,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175009,9 +175743,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175064,9 +175798,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175119,9 +175853,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175174,9 +175908,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175229,9 +175963,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175284,9 +176018,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175339,9 +176073,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175394,9 +176128,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175449,9 +176183,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175504,9 +176238,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175559,9 +176293,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175614,9 +176348,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175669,9 +176403,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175724,9 +176458,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175779,9 +176513,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175834,9 +176568,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175889,9 +176623,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175944,9 +176678,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175999,9 +176733,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176054,9 +176788,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176109,9 +176843,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176164,9 +176898,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176219,9 +176953,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176274,9 +177008,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176329,9 +177063,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176384,9 +177118,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176439,9 +177173,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176494,9 +177228,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176549,9 +177283,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176604,9 +177338,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176659,9 +177393,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176714,9 +177448,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176769,9 +177503,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176824,9 +177558,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176879,9 +177613,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176934,9 +177668,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176989,9 +177723,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177044,9 +177778,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177099,9 +177833,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177154,9 +177888,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177209,9 +177943,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177264,9 +177998,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177319,9 +178053,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177374,9 +178108,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177429,9 +178163,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177484,9 +178218,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177539,9 +178273,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177594,9 +178328,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177649,9 +178383,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177704,9 +178438,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177759,9 +178493,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177814,9 +178548,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177869,9 +178603,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177924,9 +178658,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177979,9 +178713,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178034,9 +178768,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178089,9 +178823,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178144,9 +178878,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178199,9 +178933,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178254,9 +178988,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178309,9 +179043,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178364,9 +179098,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178419,9 +179153,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178474,9 +179208,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178529,9 +179263,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178584,9 +179318,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178639,9 +179373,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178694,9 +179428,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178749,9 +179483,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178804,9 +179538,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178859,9 +179593,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178914,9 +179648,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178969,9 +179703,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179024,9 +179758,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179079,9 +179813,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179134,9 +179868,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179189,9 +179923,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179244,9 +179978,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179299,9 +180033,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179354,9 +180088,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179409,9 +180143,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179464,9 +180198,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179519,9 +180253,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179574,9 +180308,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179629,9 +180363,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179684,9 +180418,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179739,9 +180473,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179794,9 +180528,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179849,9 +180583,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179904,9 +180638,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179959,9 +180693,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180014,9 +180748,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180069,9 +180803,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180124,9 +180858,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180179,9 +180913,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180234,9 +180968,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180289,9 +181023,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180344,9 +181078,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180399,9 +181133,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180454,9 +181188,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180509,9 +181243,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180564,9 +181298,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180619,9 +181353,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180674,9 +181408,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180729,9 +181463,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180784,9 +181518,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180839,9 +181573,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180894,9 +181628,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180949,9 +181683,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181004,9 +181738,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181059,9 +181793,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181114,9 +181848,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181169,9 +181903,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181224,9 +181958,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181279,9 +182013,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181334,9 +182068,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181389,9 +182123,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181444,9 +182178,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181499,9 +182233,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181554,9 +182288,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181609,9 +182343,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181664,9 +182398,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181719,9 +182453,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181774,9 +182508,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181829,9 +182563,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181884,9 +182618,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181939,9 +182673,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181994,9 +182728,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182049,9 +182783,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182104,9 +182838,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182159,9 +182893,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182214,9 +182948,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182269,9 +183003,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182324,9 +183058,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182379,9 +183113,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182434,9 +183168,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182489,9 +183223,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182544,9 +183278,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182599,9 +183333,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182654,9 +183388,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182709,9 +183443,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182764,9 +183498,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182819,9 +183553,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182874,9 +183608,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182929,9 +183663,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182984,9 +183718,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183039,9 +183773,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183094,9 +183828,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183149,9 +183883,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183204,9 +183938,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183259,9 +183993,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183314,9 +184048,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183369,9 +184103,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183424,9 +184158,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183479,9 +184213,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183534,9 +184268,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183589,9 +184323,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183644,9 +184378,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183699,9 +184433,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183754,9 +184488,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183809,9 +184543,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183864,9 +184598,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183919,9 +184653,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183974,9 +184708,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184029,9 +184763,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184084,9 +184818,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184139,9 +184873,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184194,9 +184928,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184249,9 +184983,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184304,9 +185038,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184359,9 +185093,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184414,9 +185148,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184469,9 +185203,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184524,9 +185258,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184579,9 +185313,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184634,9 +185368,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184689,9 +185423,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184744,9 +185478,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184799,9 +185533,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184854,9 +185588,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184909,9 +185643,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184964,9 +185698,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185019,9 +185753,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185074,9 +185808,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185129,9 +185863,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185184,9 +185918,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185239,9 +185973,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185294,9 +186028,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185349,9 +186083,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185404,9 +186138,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185459,9 +186193,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185514,9 +186248,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185569,9 +186303,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185624,9 +186358,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185679,9 +186413,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185734,9 +186468,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185789,9 +186523,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185844,9 +186578,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185899,9 +186633,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -185954,9 +186688,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -186009,9 +186743,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -186064,9 +186798,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 8,
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -239342,9 +240076,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239423,9 +240157,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239504,9 +240238,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239585,9 +240319,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239666,9 +240400,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239747,9 +240481,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239828,9 +240562,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239909,9 +240643,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -239990,9 +240724,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240071,9 +240805,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240152,9 +240886,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240233,9 +240967,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240314,9 +241048,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240395,9 +241129,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240476,9 +241210,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240557,9 +241291,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240638,9 +241372,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240719,9 +241453,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240800,9 +241534,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240881,9 +241615,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -240962,9 +241696,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241043,9 +241777,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241124,9 +241858,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241205,9 +241939,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241286,9 +242020,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241367,9 +242101,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241448,9 +242182,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241529,9 +242263,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241610,9 +242344,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241691,9 +242425,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241772,9 +242506,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241853,9 +242587,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -241934,9 +242668,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242015,9 +242749,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242096,9 +242830,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242177,9 +242911,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242258,9 +242992,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242339,9 +243073,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242420,9 +243154,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242501,9 +243235,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242582,9 +243316,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242663,9 +243397,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242744,9 +243478,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242825,9 +243559,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242906,9 +243640,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -242987,9 +243721,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243068,9 +243802,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243149,9 +243883,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243230,9 +243964,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243311,9 +244045,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243392,9 +244126,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243473,9 +244207,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243554,9 +244288,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243635,9 +244369,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243716,9 +244450,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243797,9 +244531,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243878,9 +244612,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -243959,9 +244693,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244040,9 +244774,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244121,9 +244855,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244202,9 +244936,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244283,9 +245017,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244364,9 +245098,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244445,9 +245179,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244526,9 +245260,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244607,9 +245341,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244688,9 +245422,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244769,9 +245503,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244850,9 +245584,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -244931,9 +245665,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245012,9 +245746,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245093,9 +245827,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245174,9 +245908,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245255,9 +245989,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245336,9 +246070,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245417,9 +246151,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245498,9 +246232,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245579,9 +246313,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245660,9 +246394,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245741,9 +246475,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245822,9 +246556,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245903,9 +246637,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -245984,9 +246718,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246065,9 +246799,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246146,9 +246880,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246227,9 +246961,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246308,9 +247042,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246389,9 +247123,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246470,9 +247204,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246551,9 +247285,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246632,9 +247366,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246713,9 +247447,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246794,9 +247528,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246875,9 +247609,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -246956,9 +247690,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247037,9 +247771,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247118,9 +247852,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247199,9 +247933,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247280,9 +248014,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247361,9 +248095,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247442,9 +248176,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247523,9 +248257,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247604,9 +248338,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247685,9 +248419,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247766,9 +248500,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247847,9 +248581,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -247928,9 +248662,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248009,9 +248743,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248090,9 +248824,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248171,9 +248905,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248252,9 +248986,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248333,9 +249067,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248414,9 +249148,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248495,9 +249229,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248576,9 +249310,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248657,9 +249391,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248738,9 +249472,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248819,9 +249553,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248900,9 +249634,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -248981,9 +249715,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249062,9 +249796,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249143,9 +249877,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249224,9 +249958,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249305,9 +250039,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249386,9 +250120,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249467,9 +250201,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249548,9 +250282,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249629,9 +250363,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249710,9 +250444,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249791,9 +250525,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249872,9 +250606,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -249953,9 +250687,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250034,9 +250768,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250115,9 +250849,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250196,9 +250930,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250277,9 +251011,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250358,9 +251092,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250439,9 +251173,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250520,9 +251254,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250601,9 +251335,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250682,9 +251416,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250763,9 +251497,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250844,9 +251578,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -250925,9 +251659,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251006,9 +251740,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251087,9 +251821,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251168,9 +251902,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251249,9 +251983,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251330,9 +252064,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251411,9 +252145,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251492,9 +252226,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251573,9 +252307,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251654,9 +252388,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251735,9 +252469,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251816,9 +252550,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251897,9 +252631,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -251978,9 +252712,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252059,9 +252793,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252140,9 +252874,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252221,9 +252955,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252302,9 +253036,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252383,9 +253117,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252464,9 +253198,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252545,9 +253279,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252626,9 +253360,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252707,9 +253441,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252788,9 +253522,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252869,9 +253603,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -252950,9 +253684,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253031,9 +253765,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253112,9 +253846,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253193,9 +253927,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253274,9 +254008,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253355,9 +254089,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253436,9 +254170,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253517,9 +254251,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253598,9 +254332,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253679,9 +254413,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253760,9 +254494,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253841,9 +254575,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -253922,9 +254656,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254003,9 +254737,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254084,9 +254818,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254165,9 +254899,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254246,9 +254980,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254327,9 +255061,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254408,9 +255142,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254489,9 +255223,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254570,9 +255304,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254651,9 +255385,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254732,9 +255466,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254813,9 +255547,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254894,9 +255628,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -254975,9 +255709,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255056,9 +255790,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255137,9 +255871,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255218,9 +255952,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255299,9 +256033,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255380,9 +256114,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255461,9 +256195,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255542,9 +256276,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255623,9 +256357,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255704,9 +256438,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255785,9 +256519,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255866,9 +256600,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -255947,9 +256681,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256028,9 +256762,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256109,9 +256843,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256190,9 +256924,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256271,9 +257005,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256352,9 +257086,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256433,9 +257167,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256514,9 +257248,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256595,9 +257329,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256676,9 +257410,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256757,9 +257491,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256838,9 +257572,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -256919,9 +257653,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257000,9 +257734,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257081,9 +257815,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257162,9 +257896,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257243,9 +257977,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257324,9 +258058,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257405,9 +258139,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257486,9 +258220,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257567,9 +258301,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257648,9 +258382,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257729,9 +258463,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257810,9 +258544,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257891,9 +258625,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -257972,9 +258706,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258053,9 +258787,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258134,9 +258868,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258215,9 +258949,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258296,9 +259030,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258377,9 +259111,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258458,9 +259192,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258539,9 +259273,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258620,9 +259354,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258701,9 +259435,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258782,9 +259516,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258863,9 +259597,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -258944,9 +259678,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259025,9 +259759,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259106,9 +259840,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259187,9 +259921,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259268,9 +260002,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259349,9 +260083,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259430,9 +260164,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259511,9 +260245,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259592,9 +260326,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259673,9 +260407,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259754,9 +260488,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259835,9 +260569,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259916,9 +260650,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -259997,9 +260731,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260078,9 +260812,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260159,9 +260893,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260240,9 +260974,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260321,9 +261055,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260402,9 +261136,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260483,9 +261217,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260564,9 +261298,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260645,9 +261379,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260726,9 +261460,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260807,9 +261541,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260888,9 +261622,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -260969,9 +261703,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261050,9 +261784,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261131,9 +261865,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261212,9 +261946,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261293,9 +262027,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261374,9 +262108,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261455,9 +262189,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261536,9 +262270,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261617,9 +262351,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261698,9 +262432,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261779,9 +262513,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261860,9 +262594,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -261941,9 +262675,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262022,9 +262756,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262103,9 +262837,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262184,9 +262918,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262265,9 +262999,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262346,9 +263080,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262427,9 +263161,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262508,9 +263242,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262589,9 +263323,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262670,9 +263404,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262751,9 +263485,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262832,9 +263566,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262913,9 +263647,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -262994,9 +263728,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263075,9 +263809,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263156,9 +263890,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263237,9 +263971,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263318,9 +264052,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263399,9 +264133,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263480,9 +264214,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263561,9 +264295,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263642,9 +264376,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263723,9 +264457,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263804,9 +264538,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263885,9 +264619,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -263966,9 +264700,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264047,9 +264781,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264128,9 +264862,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264209,9 +264943,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264290,9 +265024,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264371,9 +265105,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264452,9 +265186,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264533,9 +265267,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264614,9 +265348,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264695,9 +265429,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264776,9 +265510,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264857,9 +265591,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -264938,9 +265672,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265019,9 +265753,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265100,9 +265834,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265181,9 +265915,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265262,9 +265996,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265343,9 +266077,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265424,9 +266158,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265505,9 +266239,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265586,9 +266320,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265667,9 +266401,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265748,9 +266482,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265829,9 +266563,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265910,9 +266644,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -265991,9 +266725,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266072,9 +266806,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266153,9 +266887,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266234,9 +266968,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266315,9 +267049,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266396,9 +267130,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266477,9 +267211,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266558,9 +267292,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266639,9 +267373,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266720,9 +267454,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266801,9 +267535,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266882,9 +267616,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -266963,9 +267697,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267044,9 +267778,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267125,9 +267859,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267206,9 +267940,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267287,9 +268021,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267368,9 +268102,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267449,9 +268183,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267530,9 +268264,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267611,9 +268345,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267692,9 +268426,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267773,9 +268507,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267854,9 +268588,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -267935,9 +268669,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268016,9 +268750,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268097,9 +268831,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268178,9 +268912,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268259,9 +268993,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268340,9 +269074,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268421,9 +269155,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268502,9 +269236,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268583,9 +269317,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268664,9 +269398,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268745,9 +269479,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268826,9 +269560,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268907,9 +269641,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -268988,9 +269722,9 @@
         },
         {
             "techniqueID": "T1027.005",
-            "score": 7,
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
         {
             "techniqueID": "T1065",
@@ -452298,7 +453032,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452501,7 +453235,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452704,7 +453438,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452907,7 +453641,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453110,7 +453844,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453313,7 +454047,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453516,7 +454250,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453719,7 +454453,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453922,7 +454656,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454125,7 +454859,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454328,7 +455062,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454531,7 +455265,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454734,7 +455468,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454937,7 +455671,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455140,7 +455874,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455343,7 +456077,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455546,7 +456280,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455749,7 +456483,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455952,7 +456686,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456155,7 +456889,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456358,7 +457092,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456561,7 +457295,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456764,7 +457498,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456967,7 +457701,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457170,7 +457904,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457373,7 +458107,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457576,7 +458310,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457779,7 +458513,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457982,7 +458716,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458185,7 +458919,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458388,7 +459122,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458591,7 +459325,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458794,7 +459528,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458997,7 +459731,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459200,7 +459934,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459403,7 +460137,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459606,7 +460340,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459809,7 +460543,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460012,7 +460746,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460215,7 +460949,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460418,7 +461152,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460621,7 +461355,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460824,7 +461558,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461027,7 +461761,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461230,7 +461964,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461433,7 +462167,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461636,7 +462370,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461839,7 +462573,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462042,7 +462776,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462245,7 +462979,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462448,7 +463182,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462651,7 +463385,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462854,7 +463588,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463057,7 +463791,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463260,7 +463994,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463463,7 +464197,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463666,7 +464400,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463869,7 +464603,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464072,7 +464806,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464275,7 +465009,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464478,7 +465212,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464681,7 +465415,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464884,7 +465618,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465087,7 +465821,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465290,7 +466024,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465493,7 +466227,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465696,7 +466430,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465899,7 +466633,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466102,7 +466836,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466305,7 +467039,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466508,7 +467242,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466711,7 +467445,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466914,7 +467648,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467117,7 +467851,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467320,7 +468054,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467523,7 +468257,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467726,7 +468460,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467929,7 +468663,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468132,7 +468866,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468335,7 +469069,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468538,7 +469272,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468741,7 +469475,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468944,7 +469678,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469147,7 +469881,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469350,7 +470084,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469553,7 +470287,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469756,7 +470490,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469959,7 +470693,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470162,7 +470896,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470365,7 +471099,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470568,7 +471302,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470771,7 +471505,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470974,7 +471708,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471177,7 +471911,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471380,7 +472114,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471583,7 +472317,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471786,7 +472520,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471989,7 +472723,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472192,7 +472926,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472395,7 +473129,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472598,7 +473332,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472801,7 +473535,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473004,7 +473738,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473207,7 +473941,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473410,7 +474144,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473613,7 +474347,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473816,7 +474550,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474019,7 +474753,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474222,7 +474956,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474425,7 +475159,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474628,7 +475362,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474831,7 +475565,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475034,7 +475768,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475237,7 +475971,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475440,7 +476174,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475643,7 +476377,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475846,7 +476580,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476049,7 +476783,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476252,7 +476986,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476455,7 +477189,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476658,7 +477392,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476861,7 +477595,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477064,7 +477798,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477267,7 +478001,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477470,7 +478204,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477673,7 +478407,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477876,7 +478610,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478079,7 +478813,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478282,7 +479016,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478485,7 +479219,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478688,7 +479422,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478891,7 +479625,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479094,7 +479828,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479297,7 +480031,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479500,7 +480234,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479703,7 +480437,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479906,7 +480640,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480109,7 +480843,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480312,7 +481046,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480515,7 +481249,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480718,7 +481452,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480921,7 +481655,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481124,7 +481858,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481327,7 +482061,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481530,7 +482264,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481733,7 +482467,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481936,7 +482670,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482139,7 +482873,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482342,7 +483076,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482545,7 +483279,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482748,7 +483482,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482951,7 +483685,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483154,7 +483888,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483357,7 +484091,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483560,7 +484294,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483763,7 +484497,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483966,7 +484700,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484169,7 +484903,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484372,7 +485106,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484575,7 +485309,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484778,7 +485512,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484981,7 +485715,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485184,7 +485918,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485387,7 +486121,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485590,7 +486324,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485793,7 +486527,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485996,7 +486730,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486199,7 +486933,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486402,7 +487136,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486605,7 +487339,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486808,7 +487542,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487011,7 +487745,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487214,7 +487948,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487417,7 +488151,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487620,7 +488354,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487823,7 +488557,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488026,7 +488760,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488229,7 +488963,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488432,7 +489166,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488635,7 +489369,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488838,7 +489572,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489041,7 +489775,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489244,7 +489978,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489447,7 +490181,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489650,7 +490384,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489853,7 +490587,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490056,7 +490790,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490259,7 +490993,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490462,7 +491196,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490665,7 +491399,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490868,7 +491602,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491071,7 +491805,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491274,7 +492008,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491477,7 +492211,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491680,7 +492414,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491883,7 +492617,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492086,7 +492820,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492289,7 +493023,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492492,7 +493226,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492695,7 +493429,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492898,7 +493632,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493101,7 +493835,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493304,7 +494038,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493507,7 +494241,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493710,7 +494444,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493913,7 +494647,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494116,7 +494850,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494319,7 +495053,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494522,7 +495256,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494725,7 +495459,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494928,7 +495662,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495131,7 +495865,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495334,7 +496068,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495537,7 +496271,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495740,7 +496474,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495943,7 +496677,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496146,7 +496880,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496349,7 +497083,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496552,7 +497286,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496755,7 +497489,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496958,7 +497692,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497161,7 +497895,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497364,7 +498098,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497567,7 +498301,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497770,7 +498504,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497973,7 +498707,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498176,7 +498910,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498379,7 +499113,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498582,7 +499316,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498785,7 +499519,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498988,7 +499722,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499191,7 +499925,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499394,7 +500128,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499597,7 +500331,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499800,7 +500534,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500003,7 +500737,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500206,7 +500940,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500409,7 +501143,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500612,7 +501346,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500815,7 +501549,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501018,7 +501752,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501221,7 +501955,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501424,7 +502158,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501627,7 +502361,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501830,7 +502564,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502033,7 +502767,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502236,7 +502970,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502439,7 +503173,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502642,7 +503376,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502845,7 +503579,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503048,7 +503782,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503251,7 +503985,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503454,7 +504188,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503657,7 +504391,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503860,7 +504594,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504063,7 +504797,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504266,7 +505000,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504469,7 +505203,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504672,7 +505406,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504875,7 +505609,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505078,7 +505812,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505281,7 +506015,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505484,7 +506218,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505687,7 +506421,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505890,7 +506624,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506093,7 +506827,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506296,7 +507030,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506499,7 +507233,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506702,7 +507436,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506905,7 +507639,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507108,7 +507842,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507311,7 +508045,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507514,7 +508248,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507717,7 +508451,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507920,7 +508654,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508123,7 +508857,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508326,7 +509060,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508529,7 +509263,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508732,7 +509466,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508935,7 +509669,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509138,7 +509872,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509341,7 +510075,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509544,7 +510278,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509747,7 +510481,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509950,7 +510684,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510153,7 +510887,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510356,7 +511090,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510559,7 +511293,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510762,7 +511496,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510965,7 +511699,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511168,7 +511902,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511371,7 +512105,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511574,7 +512308,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511777,7 +512511,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511980,7 +512714,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512183,7 +512917,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512386,7 +513120,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512589,7 +513323,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512792,7 +513526,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512995,7 +513729,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513198,7 +513932,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513401,7 +514135,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513604,7 +514338,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513807,7 +514541,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514010,7 +514744,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514213,7 +514947,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514416,7 +515150,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514619,7 +515353,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514822,7 +515556,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515025,7 +515759,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515228,7 +515962,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515431,7 +516165,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515634,7 +516368,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515837,7 +516571,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516040,7 +516774,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516243,7 +516977,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516446,7 +517180,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516649,7 +517383,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516852,7 +517586,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517055,7 +517789,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517258,7 +517992,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517461,7 +518195,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517664,7 +518398,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517867,7 +518601,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518070,7 +518804,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518273,7 +519007,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518476,7 +519210,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518679,7 +519413,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518882,7 +519616,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519085,7 +519819,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519288,7 +520022,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519491,7 +520225,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519694,7 +520428,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519897,7 +520631,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520100,7 +520834,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520303,7 +521037,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520506,7 +521240,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520709,7 +521443,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520912,7 +521646,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521115,7 +521849,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521318,7 +522052,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521521,7 +522255,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521724,7 +522458,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521927,7 +522661,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522130,7 +522864,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522333,7 +523067,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522536,7 +523270,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522739,7 +523473,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522942,7 +523676,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523145,7 +523879,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523348,7 +524082,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523551,7 +524285,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523754,7 +524488,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523957,7 +524691,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524160,7 +524894,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524363,7 +525097,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524566,7 +525300,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524769,7 +525503,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524972,7 +525706,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525175,7 +525909,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525378,7 +526112,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525581,7 +526315,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525784,7 +526518,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525987,7 +526721,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526190,7 +526924,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526393,7 +527127,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526596,7 +527330,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526691,9 +527425,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -526934,9 +527668,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -527177,9 +527911,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -527420,9 +528154,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -527663,9 +528397,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -527906,9 +528640,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -528149,9 +528883,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -528392,9 +529126,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -528635,9 +529369,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -528878,9 +529612,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -529121,9 +529855,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -529364,9 +530098,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -529607,9 +530341,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -529850,9 +530584,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -530093,9 +530827,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -530336,9 +531070,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -530579,9 +531313,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -530822,9 +531556,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -531065,9 +531799,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -531308,9 +532042,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -531551,9 +532285,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -531794,9 +532528,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -532037,9 +532771,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -532280,9 +533014,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -532523,9 +533257,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -532766,9 +533500,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -533009,9 +533743,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -533252,9 +533986,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -533495,9 +534229,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -533738,9 +534472,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -533981,9 +534715,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -534224,9 +534958,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -534467,9 +535201,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -534710,9 +535444,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -534953,9 +535687,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -535196,9 +535930,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -535439,9 +536173,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -535682,9 +536416,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -535925,9 +536659,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -536168,9 +536902,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -536411,9 +537145,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -536654,9 +537388,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -536897,9 +537631,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -537140,9 +537874,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -537383,9 +538117,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -537626,9 +538360,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -537869,9 +538603,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -538112,9 +538846,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -538355,9 +539089,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -538598,9 +539332,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -538841,9 +539575,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -539084,9 +539818,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -539327,9 +540061,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -539570,9 +540304,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -539813,9 +540547,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -540056,9 +540790,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -540299,9 +541033,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -540542,9 +541276,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -540785,9 +541519,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -541028,9 +541762,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -541271,9 +542005,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -541514,9 +542248,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -541757,9 +542491,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -542000,9 +542734,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -542243,9 +542977,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -542486,9 +543220,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -542729,9 +543463,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -542972,9 +543706,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -543215,9 +543949,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -543458,9 +544192,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -543701,9 +544435,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -543944,9 +544678,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -544187,9 +544921,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -544430,9 +545164,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -544673,9 +545407,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -544916,9 +545650,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -545159,9 +545893,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -545402,9 +546136,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -545645,9 +546379,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -545888,9 +546622,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -546131,9 +546865,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -546374,9 +547108,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -546617,9 +547351,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -546860,9 +547594,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -547103,9 +547837,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -547346,9 +548080,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -547589,9 +548323,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -547832,9 +548566,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -548075,9 +548809,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -548318,9 +549052,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -548561,9 +549295,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -548804,9 +549538,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -549047,9 +549781,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -549290,9 +550024,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -549533,9 +550267,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -549776,9 +550510,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -550019,9 +550753,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -550262,9 +550996,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -550505,9 +551239,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -550748,9 +551482,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -550991,9 +551725,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -551234,9 +551968,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -551477,9 +552211,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -551720,9 +552454,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -551963,9 +552697,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -552206,9 +552940,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -552449,9 +553183,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -552692,9 +553426,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -552935,9 +553669,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -553178,9 +553912,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -553421,9 +554155,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -553664,9 +554398,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -553907,9 +554641,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -554150,9 +554884,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -554393,9 +555127,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -554636,9 +555370,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -554879,9 +555613,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -555122,9 +555856,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -555365,9 +556099,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -555608,9 +556342,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -555851,9 +556585,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -556094,9 +556828,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -556337,9 +557071,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -556580,9 +557314,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -556823,9 +557557,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -557066,9 +557800,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -557309,9 +558043,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -557552,9 +558286,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -557795,9 +558529,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -558038,9 +558772,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -558281,9 +559015,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -558524,9 +559258,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -558767,9 +559501,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -559010,9 +559744,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -559253,9 +559987,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -559496,9 +560230,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -559739,9 +560473,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -559982,9 +560716,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -560225,9 +560959,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -560468,9 +561202,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -560711,9 +561445,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -560954,9 +561688,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -561197,9 +561931,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -561440,9 +562174,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -561683,9 +562417,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -561926,9 +562660,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -562169,9 +562903,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -562412,9 +563146,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -562655,9 +563389,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -562898,9 +563632,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -563141,9 +563875,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -563384,9 +564118,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -563627,9 +564361,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -563870,9 +564604,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -564113,9 +564847,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -564356,9 +565090,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -564599,9 +565333,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -564842,9 +565576,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -565085,9 +565819,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -565328,9 +566062,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -565571,9 +566305,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -565814,9 +566548,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -566057,9 +566791,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -566300,9 +567034,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -566543,9 +567277,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -566786,9 +567520,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -567029,9 +567763,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -567272,9 +568006,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -567515,9 +568249,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -567758,9 +568492,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -568001,9 +568735,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -568244,9 +568978,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -568487,9 +569221,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -568730,9 +569464,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -568973,9 +569707,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -569216,9 +569950,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -569459,9 +570193,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -569702,9 +570436,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -569945,9 +570679,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -570188,9 +570922,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -570431,9 +571165,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -570674,9 +571408,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -570917,9 +571651,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -571160,9 +571894,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -571403,9 +572137,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -571646,9 +572380,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -571889,9 +572623,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -572132,9 +572866,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -572375,9 +573109,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -572618,9 +573352,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -572861,9 +573595,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -573104,9 +573838,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -573347,9 +574081,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -573590,9 +574324,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -573833,9 +574567,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -574076,9 +574810,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -574319,9 +575053,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -574562,9 +575296,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -574805,9 +575539,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -575048,9 +575782,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -575291,9 +576025,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -575534,9 +576268,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -575777,9 +576511,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -576020,9 +576754,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -576263,9 +576997,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -576506,9 +577240,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -576749,9 +577483,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -576992,9 +577726,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -577235,9 +577969,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -577478,9 +578212,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -577721,9 +578455,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -577964,9 +578698,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -578207,9 +578941,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -578450,9 +579184,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -578693,9 +579427,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -578936,9 +579670,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -579179,9 +579913,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -579422,9 +580156,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -579665,9 +580399,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -579908,9 +580642,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -580151,9 +580885,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -580394,9 +581128,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -580637,9 +581371,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -580880,9 +581614,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -581123,9 +581857,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -581366,9 +582100,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -581609,9 +582343,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -581852,9 +582586,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -582095,9 +582829,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -582338,9 +583072,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -582581,9 +583315,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -582824,9 +583558,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -583067,9 +583801,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -583310,9 +584044,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -583553,9 +584287,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -583796,9 +584530,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -584039,9 +584773,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -584282,9 +585016,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -584525,9 +585259,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -584768,9 +585502,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -585011,9 +585745,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -585254,9 +585988,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -585497,9 +586231,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -585740,9 +586474,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -585983,9 +586717,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -586226,9 +586960,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -586469,9 +587203,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -586712,9 +587446,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -586955,9 +587689,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -587198,9 +587932,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -587441,9 +588175,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -587684,9 +588418,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -587927,9 +588661,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -588170,9 +588904,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -588413,9 +589147,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -588656,9 +589390,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -588899,9 +589633,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -589142,9 +589876,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -589385,9 +590119,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -589628,9 +590362,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -589871,9 +590605,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -590114,9 +590848,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -590357,9 +591091,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -590600,9 +591334,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -590843,9 +591577,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -591086,9 +591820,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -591329,9 +592063,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -591572,9 +592306,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -591815,9 +592549,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -592058,9 +592792,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -592301,9 +593035,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -592544,9 +593278,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -592787,9 +593521,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -593030,9 +593764,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -593273,9 +594007,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -593516,9 +594250,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -593759,9 +594493,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -594002,9 +594736,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -594245,9 +594979,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -594488,9 +595222,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -594731,9 +595465,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -594974,9 +595708,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -595217,9 +595951,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -595460,9 +596194,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -595703,9 +596437,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -595946,9 +596680,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -596189,9 +596923,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -596432,9 +597166,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -596675,9 +597409,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -596918,9 +597652,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -597161,9 +597895,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -597404,9 +598138,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -597647,9 +598381,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -597890,9 +598624,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -598133,9 +598867,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -598376,9 +599110,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -598619,9 +599353,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -598862,9 +599596,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -599105,9 +599839,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -599348,9 +600082,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -599591,9 +600325,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -599834,9 +600568,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -600077,9 +600811,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -600320,9 +601054,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -600563,9 +601297,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -600806,9 +601540,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -601049,9 +601783,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -601292,9 +602026,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -601535,9 +602269,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -601778,9 +602512,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -602021,9 +602755,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -602264,9 +602998,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -602507,9 +603241,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -602750,9 +603484,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -602993,9 +603727,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -603236,9 +603970,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -603479,9 +604213,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -603722,9 +604456,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -603965,9 +604699,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -604208,9 +604942,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -604451,9 +605185,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -604694,9 +605428,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -604937,9 +605671,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -605180,9 +605914,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -605423,9 +606157,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -605666,9 +606400,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -605909,9 +606643,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -606152,9 +606886,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -606395,9 +607129,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -606638,9 +607372,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -606881,9 +607615,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -607124,9 +607858,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -607367,9 +608101,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -607610,9 +608344,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -607853,9 +608587,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -608096,9 +608830,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -608339,9 +609073,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -608582,9 +609316,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -608825,9 +609559,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -609068,9 +609802,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -609311,9 +610045,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -609554,9 +610288,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -609797,9 +610531,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -610040,9 +610774,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -610283,9 +611017,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -610526,9 +611260,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -610769,9 +611503,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -611012,9 +611746,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -611255,9 +611989,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -611498,9 +612232,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -611741,9 +612475,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -611984,9 +612718,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -612227,9 +612961,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -612470,9 +613204,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -612713,9 +613447,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -612956,9 +613690,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -613199,9 +613933,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -613442,9 +614176,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -613685,9 +614419,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -613928,9 +614662,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -614171,9 +614905,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -614414,9 +615148,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -614657,9 +615391,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -614900,9 +615634,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -615143,9 +615877,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -615386,9 +616120,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
@@ -615629,9 +616363,9 @@
         },
         {
             "techniqueID": "T1489",
-            "score": -1,
+            "score": -6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
         },
         {
             "techniqueID": "T1484.002",
diff --git a/docs/stories.md b/docs/stories.md
index c2d149be41..3fd4e0c731 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -1295,6 +1295,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 
 * [Powershell Creating Thread Mutex](detections.md#powershell-creating-thread-mutex)
 
+* [Powershell Enable SMB1Protocol Feature](detections.md#powershell-enable-smb1protocol-feature)
+
 * [Powershell Fileless Process Injection via GetProcAddress](detections.md#powershell-fileless-process-injection-via-getprocaddress)
 
 * [Powershell Fileless Script Contains Base64 Encoded Content](detections.md#powershell-fileless-script-contains-base64-encoded-content)
@@ -4162,7 +4164,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.001](https://attack.mitre.org/techniques/T1569.001/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
+- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.001](https://attack.mitre.org/techniques/T1569.001/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2021-03-17
 
 

@@ -4192,6 +4194,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Resize ShadowStorage volume](detections.md#resize-shadowstorage-volume)
 
+* [Resize Shadowstorage Volume](detections.md#resize-shadowstorage-volume)
+
 * [Suspicious Event Log Service Behavior](detections.md#suspicious-event-log-service-behavior)
 
 * [Suspicious wevtutil Usage](detections.md#suspicious-wevtutil-usage)
@@ -4213,6 +4217,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1490 | Inhibit System Recovery | Impact |
 | T1486 | Data Encrypted for Impact | Impact |
 | T1003.002 | Security Account Manager | Credential Access |
+| T1489 | Service Stop | Impact |
 | T1070.001 | Clear Windows Event Logs | Defense Evasion |
 
 #### Kill Chain Phase
@@ -4693,7 +4698,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1070.004](https://attack.mitre.org/techniques/T1070.004/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1222](https://attack.mitre.org/techniques/T1222/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1592](https://attack.mitre.org/techniques/T1592/)
+- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027.005](https://attack.mitre.org/techniques/T1027.005/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1059.005](https://attack.mitre.org/techniques/T1059.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1070.004](https://attack.mitre.org/techniques/T1070.004/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1222](https://attack.mitre.org/techniques/T1222/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1531](https://attack.mitre.org/techniques/T1531/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.007](https://attack.mitre.org/techniques/T1562.007/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/), [T1574.002](https://attack.mitre.org/techniques/T1574.002/), [T1592](https://attack.mitre.org/techniques/T1592/)
 - **Last Updated**: 2020-02-04
 
 

@@ -4701,8 +4706,16 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 #### Detection Profile
 
+* [Allow File And Printing Sharing In Firewall](detections.md#allow-file-and-printing-sharing-in-firewall)
+
+* [Allow Network Discovery In Firewall](detections.md#allow-network-discovery-in-firewall)
+
 * [Allow Operation with Consent Admin](detections.md#allow-operation-with-consent-admin)
 
+* [Attempt To Disable Services](detections.md#attempt-to-disable-services)
+
+* [Attempt To delete Services](detections.md#attempt-to-delete-services)
+
 * [BCDEdit Failure Recovery Modification](detections.md#bcdedit-failure-recovery-modification)
 
 * [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
@@ -4715,6 +4728,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Conti Common Exec parameter](detections.md#conti-common-exec-parameter)
 
+* [Delete A Net User](detections.md#delete-a-net-user)
+
 * [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
 
 * [Deleting Shadow Copies](detections.md#deleting-shadow-copies)
@@ -4729,24 +4744,52 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Detect SharpHound Usage](detections.md#detect-sharphound-usage)
 
+* [Disable AMSI Through Registry](detections.md#disable-amsi-through-registry)
+
+* [Disable ETW Through Registry](detections.md#disable-etw-through-registry)
+
 * [Disable Logs Using WevtUtil](detections.md#disable-logs-using-wevtutil)
 
+* [Disable Net User Account](detections.md#disable-net-user-account)
+
+* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring)
+
+* [Excessive Service Stop Attempt](detections.md#excessive-service-stop-attempt)
+
+* [Excessive Usage Of Net App](detections.md#excessive-usage-of-net-app)
+
+* [Excessive Usage Of SC Service Utility](detections.md#excessive-usage-of-sc-service-utility)
+
+* [Execute Javascript With Jscript COM CLSID](detections.md#execute-javascript-with-jscript-com-clsid)
+
+* [ICACLS Grant Command](detections.md#icacls-grant-command)
+
 * [Known Services Killed by Ransomware](detections.md#known-services-killed-by-ransomware)
 
 * [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
 
+* [Msmpeng Application DLL Side Loading](detections.md#msmpeng-application-dll-side-loading)
+
 * [Permission Modification using Takeown App](detections.md#permission-modification-using-takeown-app)
 
+* [Powershell Disable Security Monitoring](detections.md#powershell-disable-security-monitoring)
+
+* [Powershell Enable SMB1Protocol Feature](detections.md#powershell-enable-smb1protocol-feature)
+
 * [Prevent Automatic Repair Mode using Bcdedit](detections.md#prevent-automatic-repair-mode-using-bcdedit)
 
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
 
 * [Recon AVProduct Through Pwh or WMI](detections.md#recon-avproduct-through-pwh-or-wmi)
 
+* [Recursive Delete of Directory In Batch CMD](detections.md#recursive-delete-of-directory-in-batch-cmd)
+
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [Remote Process Instantiation via WMI](detections.md#remote-process-instantiation-via-wmi)
 
+* [Resize Shadowstorage Volume](detections.md#resize-shadowstorage-volume)
+
 * [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
 
 * [Revil Registry Entry](detections.md#revil-registry-entry)
@@ -4796,7 +4839,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
+| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion |
 | T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
+| T1489 | Service Stop | Impact |
 | T1490 | Inhibit System Recovery | Impact |
 | T1218.003 | CMSTP | Defense Evasion |
 | T1070.004 | File Deletion | Defense Evasion |
@@ -4808,9 +4853,15 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1482 | Domain Trust Discovery | Discovery |
 | T1069.002 | Domain Groups | Discovery |
 | T1069.001 | Local Groups | Discovery |
+| T1562.001 | Disable or Modify Tools | Defense Evasion |
 | T1070.001 | Clear Windows Event Logs | Defense Evasion |
-| T1491 | Defacement | Impact |
+| T1531 | Account Access Removal | Impact |
+| T1569.002 | Service Execution | Execution |
+| T1059.005 | Visual Basic | Execution |
 | T1222 | File and Directory Permissions Modification | Defense Evasion |
+| T1491 | Defacement | Impact |
+| T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion |
+| T1027.005 | Indicator Removal from Tools | Defense Evasion |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1592 | Gather Victim Host Information | Reconnaissance |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -4897,7 +4948,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/)
+- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.007](https://attack.mitre.org/techniques/T1562.007/), [T1574.002](https://attack.mitre.org/techniques/T1574.002/)
 - **Last Updated**: 2021-06-04
 
 

@@ -4905,10 +4956,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 #### Detection Profile
 
+* [Allow Network Discovery In Firewall](detections.md#allow-network-discovery-in-firewall)
+
 * [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
 
+* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring)
+
 * [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
 
+* [Msmpeng Application DLL Side Loading](detections.md#msmpeng-application-dll-side-loading)
+
+* [Powershell Disable Security Monitoring](detections.md#powershell-disable-security-monitoring)
+
 * [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
 
 * [Revil Registry Entry](detections.md#revil-registry-entry)
@@ -4920,8 +4979,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
+| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion |
 | T1490 | Inhibit System Recovery | Impact |
+| T1562.001 | Disable or Modify Tools | Defense Evasion |
 | T1491 | Defacement | Impact |
+| T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion |
 | T1204 | User Execution | Execution |
 | T1112 | Modify Registry | Defense Evasion |
 | T1218.003 | CMSTP | Defense Evasion |
@@ -5391,10 +5453,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 #### Detection Profile
 
+* [Attempt To Disable Services](detections.md#attempt-to-disable-services)
+
+* [Attempt To delete Services](detections.md#attempt-to-delete-services)
+
+* [Delete A Net User](detections.md#delete-a-net-user)
+
 * [Deleting Of Net Users](detections.md#deleting-of-net-users)
 
 * [Deny Permission using Cacls Utility](detections.md#deny-permission-using-cacls-utility)
 
+* [Disable Net User Account](detections.md#disable-net-user-account)
+
 * [Disable Windows App Hotkeys](detections.md#disable-windows-app-hotkeys)
 
 * [Disabling Net User Account](detections.md#disabling-net-user-account)
@@ -5442,12 +5512,12 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
+| T1489 | Service Stop | Impact |
 | T1531 | Account Access Removal | Impact |
 | T1222 | File and Directory Permissions Modification | Defense Evasion |
 | T1562.001 | Disable or Modify Tools | Defense Evasion |
 | T1105 | Ingress Tool Transfer | Command And Control |
 | T1087 | Account Discovery | Discovery |
-| T1489 | Service Stop | Impact |
 | T1036 | Masquerading | Defense Evasion |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
diff --git a/docs/stories.wiki b/docs/stories.wiki
index ddd0b29910..4be9556c9b 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -1744,6 +1744,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 
 * [[Documentation:ESSOC:detections:Detections#Powershell_creating_thread_mutex|Powershell Creating Thread Mutex]]
 
+* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
+
 * [[Documentation:ESSOC:detections:Detections#Powershell_fileless_process_injection_via_getprocaddress|Powershell Fileless Process Injection via GetProcAddress]]
 
 * [[Documentation:ESSOC:detections:Detections#Powershell_fileless_script_contains_base64_encoded_content|Powershell Fileless Script Contains Base64 Encoded Content]]
@@ -5468,7 +5470,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.001/ T1569.001], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.001/ T1569.001], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 * '''Last Updated''': 2021-03-17
 
 

@@ -5498,6 +5500,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize ShadowStorage volume]]
 
+* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
+
 * [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
@@ -5546,6 +5550,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Security Account Manager
 | Credential Access
 |-
+| T1489
+| Service Stop
+| Impact
+|-
 | T1070.001
 | Clear Windows Event Logs
 | Defense Evasion
@@ -6209,7 +6217,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.005/ T1059.005], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070]
 * '''Last Updated''': 2020-02-04
 
 

@@ -6217,8 +6225,16 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Allow_file_and_printing_sharing_in_firewall|Allow File And Printing Sharing In Firewall]]
+
+* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
+
 * [[Documentation:ESSOC:detections:Detections#Allow_operation_with_consent_admin|Allow Operation with Consent Admin]]
 
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
+
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
+
 * [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
 
 * [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
@@ -6231,6 +6247,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Conti_common_exec_parameter|Conti Common Exec parameter]]
 
+* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
+
 * [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
 
 * [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
@@ -6245,24 +6263,52 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Detect_sharphound_usage|Detect SharpHound Usage]]
 
+* [[Documentation:ESSOC:detections:Detections#Disable_amsi_through_registry|Disable AMSI Through Registry]]
+
+* [[Documentation:ESSOC:detections:Detections#Disable_etw_through_registry|Disable ETW Through Registry]]
+
 * [[Documentation:ESSOC:detections:Detections#Disable_logs_using_wevtutil|Disable Logs Using WevtUtil]]
 
+* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
+
+* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
+
+* [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]
+
+* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]
+
+* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_sc_service_utility|Excessive Usage Of SC Service Utility]]
+
+* [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]
+
+* [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
+
 * [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]
 
 * [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
 
+* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
+
 * [[Documentation:ESSOC:detections:Detections#Permission_modification_using_takeown_app|Permission Modification using Takeown App]]
 
+* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
+
+* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
+
 * [[Documentation:ESSOC:detections:Detections#Prevent_automatic_repair_mode_using_bcdedit|Prevent Automatic Repair Mode using Bcdedit]]
 
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
 
 * [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]
 
+* [[Documentation:ESSOC:detections:Detections#Recursive_delete_of_directory_in_batch_cmd|Recursive Delete of Directory In Batch CMD]]
+
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
 
+* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
+
 * [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
 
 * [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
@@ -6315,10 +6361,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 ! Technique
 ! Tactic
 |-
+| T1562.007
+| Disable or Modify Cloud Firewall
+| Defense Evasion
+|-
 | T1548
 | Abuse Elevation Control Mechanism
 | Privilege Escalation, Defense Evasion
 |-
+| T1489
+| Service Stop
+| Impact
+|-
 | T1490
 | Inhibit System Recovery
 | Impact
@@ -6363,16 +6417,40 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Local Groups
 | Discovery
 |-
+| T1562.001
+| Disable or Modify Tools
+| Defense Evasion
+|-
 | T1070.001
 | Clear Windows Event Logs
 | Defense Evasion
 |-
+| T1531
+| Account Access Removal
+| Impact
+|-
+| T1569.002
+| Service Execution
+| Execution
+|-
+| T1059.005
+| Visual Basic
+| Execution
+|-
+| T1222
+| File and Directory Permissions Modification
+| Defense Evasion
+|-
 | T1491
 | Defacement
 | Impact
 |-
-| T1222
-| File and Directory Permissions Modification
+| T1574.002
+| DLL Side-Loading
+| Persistence, Privilege Escalation, Defense Evasion
+|-
+| T1027.005
+| Indicator Removal from Tools
 | Defense Evasion
 |-
 | T1048
@@ -6501,7 +6579,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 * '''Last Updated''': 2021-06-04
 
 

@@ -6509,10 +6587,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
+
 * [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
 
+* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
+
 * [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
 
+* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
+
+* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
+
 * [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
 
 * [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
@@ -6527,14 +6613,26 @@ Leverage searches that allow you to detect and investigate unusual activities th
 ! Technique
 ! Tactic
 |-
+| T1562.007
+| Disable or Modify Cloud Firewall
+| Defense Evasion
+|-
 | T1490
 | Inhibit System Recovery
 | Impact
 |-
+| T1562.001
+| Disable or Modify Tools
+| Defense Evasion
+|-
 | T1491
 | Defacement
 | Impact
 |-
+| T1574.002
+| DLL Side-Loading
+| Persistence, Privilege Escalation, Defense Evasion
+|-
 | T1204
 | User Execution
 | Execution
@@ -7184,7 +7282,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
 * '''Last Updated''': 2021-05-07
 
 

@@ -7192,10 +7290,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
+
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
+
+* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
+
 * [[Documentation:ESSOC:detections:Detections#Deleting_of_net_users|Deleting Of Net Users]]
 
 * [[Documentation:ESSOC:detections:Detections#Deny_permission_using_cacls_utility|Deny Permission using Cacls Utility]]
 
+* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
+
 * [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]
 
 * [[Documentation:ESSOC:detections:Detections#Disabling_net_user_account|Disabling Net User Account]]
@@ -7246,6 +7352,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 ! Technique
 ! Tactic
 |-
+| T1489
+| Service Stop
+| Impact
+|-
 | T1531
 | Account Access Removal
 | Impact
@@ -7266,10 +7376,6 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Account Discovery
 | Discovery
 |-
-| T1489
-| Service Stop
-| Impact
-|-
 | T1036
 | Masquerading
 | Defense Evasion
@@ -7423,7 +7529,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-07-02 15:57:11.500371 UTC
+# On Date: 2021-07-13 23:18:20.194549 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############